Cisco ACS 5.8 Automated Backups

 

Today I attempted to configure our ACS server to backup to our new SFTP server. I deployed the SFTP server using CentOS and ensured that it only allowed the the user to SFTP and not SSH (connections to the bash shell of my box).

useradd –m sftpbackup –s /sbin/nologin –g ftpaccess
#(create user and assign to group)
passwd sftpbackup
#(set password for username)
chown root /home/sftpbackup
# (assign root owernship for the home diretory for chroot access)
chmod 750 /home/sftpbackup
#(modify permissions)
mkdir /home/sftpbackup/backup
#(create a backup directory for writing)
chown sftpbackup:ftpaccess /home/sftpbackup/backup
#(modify permissions for owner and group)

Setting Up ACS for Backup

After installing and configuring ACS (source for another blog post), I set up a a ‘Software Repository’. You can see in the image below:

1. Is the ‘Software Repository’ – This is where you define the SFTP server, the path, IP address and credentials to be used.

2. Scheduled Backups – Here you define the frequency of the backup and the specific ‘Software Repository’ to use.

We can now create a ‘Software Repository’

Here you can see that the protocol we are using is SFTP and the IP address of the server is 1.1.1.1. We can also see that there is a path for the backup of ‘/backup’. NOTE: If you use a space in the folder name you are going to need to escape the spaces. If you do not feel comfortable doing so, don’t use spaces.

Here we define what the prefix to the file will be, the encryption password to encrypt the backup file, the repository name, and finally the frequency.

This however did not work for me and I will add the troubleshooting steps I took.

NOTE: ACS DOES NOT LIKE PASSWORDS LONGER THAN 16 CHARACTERS

Clock Setting

Leave it to Cisco to not make the clock command like other devices. For this to work in my timezone, this is the commands I needed to type:

clock timezone EST
clock set Oct 24 20:39:00 2016

Once you have your time squared away, it will restart the ACS services. To validate if the services are up or not, type

sh application status acs

ACS role: PRIMARY

Process 'database' running
Process 'management' running
Process 'runtime' running
Process 'adclient' running
Process 'ntpd' running
Process 'view-database' running
Process 'view-jobmanager' running
Process 'view-alertmanager' running
Process 'view-collector' running
Process 'view-logprocessor' running

Importing Keys

Now that your time is in sync and your services are backup, I needed to import the key from my SFTP server. To do this:

crypto host_key add host 1.1.1.1
host key fingerprint added
# Host 1.1.1.1 found: line 1 type RSA
2048 9e: <output removed> .121 (RSA)

After this I tested the backup and the world was a much brighter place.

monkey-acs-01/admin# acs backup monkey-acs-01 repository sftp.fakemonkey.com
Please enter backup encryption password [8-32 chars]:
Please enter the password again:
Calculating disk size for /opt/backup/backup-monkey-acs-01-161025-0025-1477355154
Total size of backup files are 9 M.
Max Size defined for backup files are 107051 M.

% backup in progress: Completing Backup…100% completed
ACS backup file ‘monkey-acs-01-161025-0025.tar.gpg’ successfully copied to repository ‘sftp.fakemonkey.com’