Backup via CLI Script

When going between EJBCA Cloud 2.5.x and a newer version, there was a change in the base OS version and subsequently the openssl version (1.0.1 to 1.1.1) used on those systems.  The backup script encrypts the backup file with openssl and in these version changes the default digest used to encrypt files was also changed.

In the older VMs that are CentOS7 based, the backup script needs to be edited to use a newer digest.

There is a line in the backup file located at /opt/PrimeKey/support/system_backup.sh where it encrypts the file.  This line looks like the following:

BASH

 openssl enc -aes-256-ofb -e -in $tgzname>"$tgzname.enc"

This line needs to become:

BASH

openssl enc -aes-256-ofb -md sha256 -e -in $tgzname>"$tgzname.enc"

Then, similarly on the new host in the restore script on the new host (adding -md sha256) :

CODE

openssl enc -aes-256-ofb -md sha256 -d -in "${BACKUPFILE}" -out "${BACKUPFILE}.enc"

To backup an instance of EJBCA Cloud on Azure, you can either use the CLI script included on the instance or create a snapshot in the Azure Portal. 

The following describes how to backup using a script. For information on using the Azure Portal with snapshots, see Backup using Azure Snapshot.

Backup via Script

To backup the instance using the script included on the instance:

1. If you selected ssh key access when procuring your instance, use the SSH key that you selected when procuring the instance. If you chose username and password, use the combination you chose at launch time to SSH into the EJBCA Cloud instance. For example, for azure-user with an IP address of 40.118.253.3 use the following:
   

   CODE

   # ssh azure-user@40.118.253.3

   

2. Run the command sudo su to get elevated privileges:

   CODE

   # sudo su

3. Change to the /opt/PrimeKey/support directory.
4. Run the script system_backup.sh to create a backup of your system.
5. Press Y to proceed and enter a password to protect the backup once prompted:
   

   

   
   

   
   

6. Make a note of the name of the backup file created. Copy the backup file to a directory that is accessible by the azure-user, for example /home/azure-user/.
   In this case, the file named:
   "/opt/PrimeKey/support/backup_files/ejbca_db-40.118.253.3-1556223266.tar.gz"
   is copied to /home/azure-user/:

   CODE

   # cp backup_files/ejbca_db-40.118.253.3-1556223266.tar.gz /home/azure-user/

NOTE It is recommended to copy this backup to another system, either locally from your administration workstation, or in another Azure region. For more information on how to copy the file from the EJBCA Cloud instance, see the Copying Backup Files to Other Systems section.

NOTE For instructions on how to automate the backup of the system in order not to prompt for passwords, see the Optional - Automating the backup script with Cron section.