96 lines
4.3 KiB
Bash
96 lines
4.3 KiB
Bash
#!/usr/bin/env bash
|
|
# Sichert die durch 50-paw-install.yml relevante PAW-Netzwerkkonfiguration.
|
|
set -Eeuo pipefail
|
|
IFS=$'\n\t'
|
|
umask 077
|
|
|
|
DEST="${1:?Aufruf: sudo $0 /pfad/zum/backup/network}"
|
|
[[ $EUID -eq 0 ]] || { echo "FEHLER: Bitte als root ausführen." >&2; exit 1; }
|
|
|
|
mkdir -p "$DEST"/{rootfs,metadata,state}
|
|
|
|
copy_path() {
|
|
local src="$1" rel
|
|
[[ -e "$src" ]] || return 0
|
|
rel="${src#/}"
|
|
mkdir -p "$DEST/rootfs/$(dirname "$rel")"
|
|
rsync -aHAX --numeric-ids "$src" "$DEST/rootfs/$rel"
|
|
printf '%s\t%s\n' "$src" "rootfs/$rel" >> "$DEST/metadata/files.tsv"
|
|
}
|
|
|
|
: > "$DEST/metadata/files.tsv"
|
|
|
|
# Genau die Pfade, die 50-paw-install.yml installiert bzw. verwendet.
|
|
copy_path /etc/NetworkManager/system-connections
|
|
copy_path /etc/NetworkManager/dispatcher.d
|
|
copy_path /etc/libvirt/qemu/networks
|
|
copy_path /etc/sysctl.d
|
|
copy_path /usr/local/bin/ufw-paw.sh
|
|
copy_path /etc/default/ufw
|
|
copy_path /etc/ufw
|
|
copy_path /etc/iproute2/rt_tables
|
|
copy_path /hilden
|
|
|
|
# Laufzeit-Zustand dokumentieren.
|
|
ip -details link show > "$DEST/state/ip-link.txt"
|
|
ip -details address show > "$DEST/state/ip-address.txt"
|
|
ip route show table all > "$DEST/state/ip-routes-all.txt"
|
|
ip rule show > "$DEST/state/ip-rules.txt"
|
|
bridge link show > "$DEST/state/bridge-links.txt" 2>/dev/null || true
|
|
bridge vlan show > "$DEST/state/bridge-vlans.txt" 2>/dev/null || true
|
|
nmcli -f all connection show > "$DEST/state/nm-connections.txt" 2>/dev/null || true
|
|
nmcli -f all device status > "$DEST/state/nm-devices.txt" 2>/dev/null || true
|
|
nmcli --show-secrets connection show > "$DEST/state/nm-connections-with-secrets.txt" 2>/dev/null || true
|
|
nft list ruleset > "$DEST/state/nftables.txt" 2>/dev/null || true
|
|
ufw status verbose > "$DEST/state/ufw-status.txt" 2>/dev/null || true
|
|
|
|
# Bridge-MAC sichern. Diese ist für DHCP-Leases/Netzidentität relevant.
|
|
if [[ -e /sys/class/net/br-lan/address ]]; then
|
|
cat /sys/class/net/br-lan/address > "$DEST/metadata/br-lan.mac"
|
|
fi
|
|
|
|
# Permanente MAC, aktuelle MAC und Hardwarepfad aller Interfaces erfassen.
|
|
printf 'interface\tcurrent_mac\tpermanent_mac\tifindex\tdriver\tdevice_path\tid_path\tid_net_name_path\tid_net_name_mac\n' \
|
|
> "$DEST/metadata/interfaces.tsv"
|
|
|
|
for sysdev in /sys/class/net/*; do
|
|
iface="${sysdev##*/}"
|
|
current="$(cat "$sysdev/address" 2>/dev/null || true)"
|
|
permanent="$(ethtool -P "$iface" 2>/dev/null | awk '{print $3}' || true)"
|
|
[[ "$permanent" =~ ^([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}$ ]] || permanent="$current"
|
|
ifindex="$(cat "$sysdev/ifindex" 2>/dev/null || true)"
|
|
driver="$(basename "$(readlink -f "$sysdev/device/driver" 2>/dev/null)" 2>/dev/null || true)"
|
|
device_path="$(readlink -f "$sysdev/device" 2>/dev/null || true)"
|
|
props="$(udevadm info -q property -p "$sysdev" 2>/dev/null || true)"
|
|
id_path="$(awk -F= '$1=="ID_PATH"{print substr($0,index($0,"=")+1)}' <<<"$props")"
|
|
id_name_path="$(awk -F= '$1=="ID_NET_NAME_PATH"{print substr($0,index($0,"=")+1)}' <<<"$props")"
|
|
id_name_mac="$(awk -F= '$1=="ID_NET_NAME_MAC"{print substr($0,index($0,"=")+1)}' <<<"$props")"
|
|
printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
|
|
"$iface" "$current" "$permanent" "$ifindex" "$driver" "$device_path" \
|
|
"$id_path" "$id_name_path" "$id_name_mac" >> "$DEST/metadata/interfaces.tsv"
|
|
done
|
|
|
|
# Die in den PAW-Keyfiles verwendeten Ports inklusive ihrer permanenten MAC sichern.
|
|
printf 'profile\tconnection_id\told_interface\tpermanent_mac\tmaster\n' \
|
|
> "$DEST/metadata/paw-ports.tsv"
|
|
shopt -s nullglob
|
|
for profile in /etc/NetworkManager/system-connections/*.nmconnection; do
|
|
type="$(awk -F= '$1=="type"{print $2; exit}' "$profile")"
|
|
[[ "$type" == "ethernet" ]] || continue
|
|
master="$(awk -F= '$1=="master"{print $2; exit}' "$profile")"
|
|
[[ "$master" == "br-lan" ]] || continue
|
|
con_id="$(awk -F= '$1=="id"{print $2; exit}' "$profile")"
|
|
old_if="$(awk -F= '$1=="interface-name"{print $2; exit}' "$profile")"
|
|
pmac=""
|
|
if [[ -n "$old_if" && -e "/sys/class/net/$old_if" ]]; then
|
|
pmac="$(ethtool -P "$old_if" 2>/dev/null | awk '{print $3}' || true)"
|
|
[[ "$pmac" =~ ^([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}$ ]] || pmac="$(cat "/sys/class/net/$old_if/address")"
|
|
fi
|
|
printf '%s\t%s\t%s\t%s\t%s\n' "$(basename "$profile")" "$con_id" "$old_if" "$pmac" "$master" \
|
|
>> "$DEST/metadata/paw-ports.tsv"
|
|
done
|
|
|
|
chmod -R go-rwx "$DEST"
|
|
echo "PAW-Netzwerk gesichert: $DEST"
|
|
[[ -f "$DEST/metadata/br-lan.mac" ]] && echo "br-lan MAC: $(cat "$DEST/metadata/br-lan.mac")"
|