数据备份策略：3-2-1原则与实际操作

#!/bin/bash
# backup.sh - 服务器增量备份脚本

# 配置
BACKUP_SRC="/var/www /etc /home"
BACKUP_DEST="/backup/daily"
REMOTE_DEST="backup@remote-server:/backup/$(hostname)"
LOG_FILE="/var/log/backup.log"
RETENTION_DAYS=30

# 日期
DATE=$(date +%Y-%m-%d_%H%M)
BACKUP_DIR="${BACKUP_DEST}/${DATE}"
LATEST_LINK="${BACKUP_DEST}/latest"

# 创建备份目录
mkdir -p "${BACKUP_DIR}"

# 使用rsync增量备份（硬链接节省空间）
rsync -avz --delete \
  --link-dest="${LATEST_LINK}" \
  ${BACKUP_SRC} \
  "${BACKUP_DIR}" \
  >> ${LOG_FILE} 2>&1

# 更新latest链接
rm -f "${LATEST_LINK}"
ln -s "${BACKUP_DIR}" "${LATEST_LINK}"

# 同步到远程服务器（异地备份）
rsync -avz --delete \
  "${BACKUP_DIR}" \
  "${REMOTE_DEST}/" \
  >> ${LOG_FILE} 2>&1

# 清理过期备份
find ${BACKUP_DEST} -maxdepth 1 -type d -mtime +${RETENTION_DAYS} -exec rm -rf {} \;

echo "[$(date)] 备份完成: ${BACKUP_DIR}" >> ${LOG_FILE}

#!/bin/bash
# db-backup.sh - MySQL数据库备份

DB_USER="backup_user"
DB_PASS="secure_password"
BACKUP_DIR="/backup/database"
DATE=$(date +%Y-%m-%d_%H%M)
RETENTION_DAYS=14

mkdir -p ${BACKUP_DIR}

# 备份所有数据库
mysqldump --user=${DB_USER} --password=${DB_PASS} \
  --all-databases \
  --single-transaction \
  --routines \
  --triggers \
  --events \
  --flush-logs \
  | gzip > "${BACKUP_DIR}/all-databases-${DATE}.sql.gz"

# 验证备份文件
if [ -s "${BACKUP_DIR}/all-databases-${DATE}.sql.gz" ]; then
    echo "[$(date)] 数据库备份成功" >> /var/log/backup.log

    # 计算校验和
    sha256sum "${BACKUP_DIR}/all-databases-${DATE}.sql.gz" > \
      "${BACKUP_DIR}/all-databases-${DATE}.sql.gz.sha256"
else
    echo "[$(date)] 数据库备份失败！" >> /var/log/backup.log
    # 发送告警
    echo "数据库备份失败" | mail -s "ALERT: Backup Failed" [email protected]
fi

# 清理过期备份
find ${BACKUP_DIR} -name "*.sql.gz" -mtime +${RETENTION_DAYS} -delete
find ${BACKUP_DIR} -name "*.sha256" -mtime +${RETENTION_DAYS} -delete

# 安装restic
sudo apt install restic -y

# 初始化备份仓库
restic init --repo /backup/restic-repo

# 初始化S3远程仓库
export AWS_ACCESS_KEY_ID="your-key"
export AWS_SECRET_ACCESS_KEY="your-secret"
restic init --repo s3:s3.amazonaws.com/your-bucket

# 执行备份
restic backup --repo /backup/restic-repo \
  /var/www /etc /home \
  --exclude="*.tmp" \
  --exclude="*.log" \
  --tag "daily"

# 查看快照
restic snapshots --repo /backup/restic-repo

# 恢复数据
restic restore latest --repo /backup/restic-repo --target /restore/

# 自动清理旧备份
restic forget --repo /backup/restic-repo \
  --keep-daily 7 \
  --keep-weekly 4 \
  --keep-monthly 12 \
  --prune

# /etc/cron.d/backup-schedule
# 每日凌晨2点执行文件备份
0 2 * * * root /opt/scripts/backup.sh

# 每日凌晨3点执行数据库备份
0 3 * * * root /opt/scripts/db-backup.sh

# 每周日凌晨4点执行完整备份和远程同步
0 4 * * 0 root /opt/scripts/full-backup.sh

# 每月1日验证备份完整性
0 5 1 * * root /opt/scripts/verify-backup.sh

#!/bin/bash
# verify-backup.sh - 备份验证脚本

RESTORE_DIR="/tmp/backup-verify-$(date +%s)"
mkdir -p ${RESTORE_DIR}

echo "=== 备份验证开始 ==="

# 1. 验证备份文件完整性
echo "检查备份文件校验和..."
cd /backup/daily/latest
sha256sum -c /backup/checksums/latest.sha256
CHECKSUM_RESULT=$?

# 2. 尝试恢复数据库到临时实例
echo "测试数据库恢复..."
LATEST_DB=$(ls -t /backup/database/*.sql.gz | head -1)
gunzip -t ${LATEST_DB}
DB_RESULT=$?

# 3. 检查恢复的文件结构
echo "验证关键文件..."
CRITICAL_FILES=(
    "/etc/nginx/nginx.conf"
    "/etc/ssh/sshd_config"
    "/var/www/html/index.html"
)

FILE_RESULT=0
for file in "${CRITICAL_FILES[@]}"; do
    if [ ! -f "/backup/daily/latest${file}" ]; then
        echo "缺失: ${file}"
        FILE_RESULT=1
    fi
done

# 4. 报告结果
if [ $CHECKSUM_RESULT -eq 0 ] && [ $DB_RESULT -eq 0 ] && [ $FILE_RESULT -eq 0 ]; then
    echo "备份验证通过"
else
    echo "备份验证失败！请立即检查"
    echo "备份验证失败" | mail -s "CRITICAL: Backup Verification Failed" [email protected]
fi

rm -rf ${RESTORE_DIR}