Apply grandfather-father-son retention to a year of backups, encrypted

short · 45 min · Objective 4.4

Task

Generate a year of daily backup files, then write the retention script that keeps a grandfather-father-son set -- the last 7 dailies, the last 4 Sunday weeklies and the last 12 first-of-month monthlies -- and reports what it would delete. Encrypt one backup and prove it restores with its key and not without it, then check your whole arrangement against the 3-2-1 rule.

Steps

  1. Create one file per day for the last 400 days in /srv/rotation, named backup-YYYY-MM-DD.tgz, using a loop over date -d offsets.
  2. Write lab/rotation/gfs.sh that prints KEEP daily, KEEP weekly, KEEP monthly or DELETE before each file name, where a file kept for more than one reason is printed once. The weeklies are the 4 most recent Sundays and the monthlies the 12 most recent 1sts, counted whether or not a newer rule already keeps them. Save its output to lab/rotation/plan.txt.
  3. Encrypt one real small tar backup with openssl enc -aes-256-cbc -pbkdf2, decrypt it with the right passphrase into a new file, and try a wrong passphrase. Save both results to lab/rotation/crypto.txt.
  4. Write lab/rotation/321.csv with header copy,location,media,offsite,offline_or_immutable, with yes or no in the last two columns, for how your lab's backups would satisfy 3-2-1, plus the extra offline copy.
  5. Record in lab/rotation/key.txt where the encryption key is kept and how it would be found if the backup server were lost.

Verify

These checks run in a POSIX shell: Terminal on macOS or Linux, and on Windows Git Bash (it comes with Git for Windows) or WSL. A stock Windows PowerShell or Command Prompt has no awk or grep, so there the first line fails.

ls /srv/rotation | wc -l
grep -c '^KEEP' lab/rotation/plan.txt
grep -c '^DELETE' lab/rotation/plan.txt
grep -Eic 'bad decrypt|error' lab/rotation/crypto.txt
awk -F, 'NR>1 {n++; if ($4=="yes") o++; m[$3]++} END {print n" copies, "o+0" offsite, "length(m)" media type(s)"}' lab/rotation/321.csv
grep -Eic 'separate|offsite|vault|escrow' lab/rotation/key.txt

Four hundred files, of which 21 or 22 are kept and the rest marked for deletion. Seven dailies always include one Sunday, so the weeklies add exactly three more, and the monthlies add twelve -- less one when a 1st falls in the last 27 days the dailies and weeklies cover. Two 1sts are always at least 28 days apart, so at most one can: 22 on most days, 21 on the rest. The wrong passphrase failed with a bad decrypt error. Your 3-2-1 table needs at least three copies, two media types and one off site; a key stored only on the backup server fails the key test.

Notes

Many backup products express the same scheme as retention settings rather than media rotation, such as keeping 7 daily, 4 weekly and 12 monthly restore points, and apply it for you. Knowing what the setting means is what lets you check it meets the retention policy.

This is an independent study companion for CompTIA Server+ SK0-005 and is not produced by or endorsed by CompTIA.