Dateien nach "/" hochladen

2026-07-14 08:07:49 +00:00
parent e73405ea51
commit aad3cc29f1
5 changed files with 317 additions and 3 deletions
@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# Sichert die durch 50-paw-install.yml relevante PAW-Netzwerkkonfiguration.
+set -Eeuo pipefail
+IFS=$'\n\t'
+umask 077
+
+DEST="${1:?Aufruf: sudo $0 /pfad/zum/backup/network}"
+[[ $EUID -eq 0 ]] || { echo "FEHLER: Bitte als root ausführen." >&2; exit 1; }
+
+mkdir -p "$DEST"/{rootfs,metadata,state}
+
+copy_path() {
+  local src="$1" rel
+  [[ -e "$src" ]] || return 0
+  rel="${src#/}"
+  mkdir -p "$DEST/rootfs/$(dirname "$rel")"
+  rsync -aHAX --numeric-ids "$src" "$DEST/rootfs/$rel"
+  printf '%s\t%s\n' "$src" "rootfs/$rel" >> "$DEST/metadata/files.tsv"
+}
+
+: > "$DEST/metadata/files.tsv"
+
+# Genau die Pfade, die 50-paw-install.yml installiert bzw. verwendet.
+copy_path /etc/NetworkManager/system-connections
+copy_path /etc/NetworkManager/dispatcher.d
+copy_path /etc/libvirt/qemu/networks
+copy_path /etc/sysctl.d
+copy_path /usr/local/bin/ufw-paw.sh
+copy_path /etc/default/ufw
+copy_path /etc/ufw
+copy_path /etc/iproute2/rt_tables
+copy_path /hilden
+
+# Laufzeit-Zustand dokumentieren.
+ip -details link show > "$DEST/state/ip-link.txt"
+ip -details address show > "$DEST/state/ip-address.txt"
+ip route show table all > "$DEST/state/ip-routes-all.txt"
+ip rule show > "$DEST/state/ip-rules.txt"
+bridge link show > "$DEST/state/bridge-links.txt" 2>/dev/null || true
+bridge vlan show > "$DEST/state/bridge-vlans.txt" 2>/dev/null || true
+nmcli -f all connection show > "$DEST/state/nm-connections.txt" 2>/dev/null || true
+nmcli -f all device status > "$DEST/state/nm-devices.txt" 2>/dev/null || true
+nmcli --show-secrets connection show > "$DEST/state/nm-connections-with-secrets.txt" 2>/dev/null || true
+nft list ruleset > "$DEST/state/nftables.txt" 2>/dev/null || true
+ufw status verbose > "$DEST/state/ufw-status.txt" 2>/dev/null || true
+
+# Bridge-MAC sichern. Diese ist für DHCP-Leases/Netzidentität relevant.
+if [[ -e /sys/class/net/br-lan/address ]]; then
+  cat /sys/class/net/br-lan/address > "$DEST/metadata/br-lan.mac"
+fi
+
+# Permanente MAC, aktuelle MAC und Hardwarepfad aller Interfaces erfassen.
+printf 'interface\tcurrent_mac\tpermanent_mac\tifindex\tdriver\tdevice_path\tid_path\tid_net_name_path\tid_net_name_mac\n' \
+  > "$DEST/metadata/interfaces.tsv"
+
+for sysdev in /sys/class/net/*; do
+  iface="${sysdev##*/}"
+  current="$(cat "$sysdev/address" 2>/dev/null || true)"
+  permanent="$(ethtool -P "$iface" 2>/dev/null | awk '{print $3}' || true)"
+  [[ "$permanent" =~ ^([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}$ ]] || permanent="$current"
+  ifindex="$(cat "$sysdev/ifindex" 2>/dev/null || true)"
+  driver="$(basename "$(readlink -f "$sysdev/device/driver" 2>/dev/null)" 2>/dev/null || true)"
+  device_path="$(readlink -f "$sysdev/device" 2>/dev/null || true)"
+  props="$(udevadm info -q property -p "$sysdev" 2>/dev/null || true)"
+  id_path="$(awk -F= '$1=="ID_PATH"{print substr($0,index($0,"=")+1)}' <<<"$props")"
+  id_name_path="$(awk -F= '$1=="ID_NET_NAME_PATH"{print substr($0,index($0,"=")+1)}' <<<"$props")"
+  id_name_mac="$(awk -F= '$1=="ID_NET_NAME_MAC"{print substr($0,index($0,"=")+1)}' <<<"$props")"
+  printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
+    "$iface" "$current" "$permanent" "$ifindex" "$driver" "$device_path" \
+    "$id_path" "$id_name_path" "$id_name_mac" >> "$DEST/metadata/interfaces.tsv"
+done
+
+# Die in den PAW-Keyfiles verwendeten Ports inklusive ihrer permanenten MAC sichern.
+printf 'profile\tconnection_id\told_interface\tpermanent_mac\tmaster\n' \
+  > "$DEST/metadata/paw-ports.tsv"
+shopt -s nullglob
+for profile in /etc/NetworkManager/system-connections/*.nmconnection; do
+  type="$(awk -F= '$1=="type"{print $2; exit}' "$profile")"
+  [[ "$type" == "ethernet" ]] || continue
+  master="$(awk -F= '$1=="master"{print $2; exit}' "$profile")"
+  [[ "$master" == "br-lan" ]] || continue
+  con_id="$(awk -F= '$1=="id"{print $2; exit}' "$profile")"
+  old_if="$(awk -F= '$1=="interface-name"{print $2; exit}' "$profile")"
+  pmac=""
+  if [[ -n "$old_if" && -e "/sys/class/net/$old_if" ]]; then
+    pmac="$(ethtool -P "$old_if" 2>/dev/null | awk '{print $3}' || true)"
+    [[ "$pmac" =~ ^([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}$ ]] || pmac="$(cat "/sys/class/net/$old_if/address")"
+  fi
+  printf '%s\t%s\t%s\t%s\t%s\n' "$(basename "$profile")" "$con_id" "$old_if" "$pmac" "$master" \
+    >> "$DEST/metadata/paw-ports.tsv"
+done
+
+chmod -R go-rwx "$DEST"
+echo "PAW-Netzwerk gesichert: $DEST"
+[[ -f "$DEST/metadata/br-lan.mac" ]] && echo "br-lan MAC: $(cat "$DEST/metadata/br-lan.mac")"