Burp(8)
β¨ Burp(8) β¨
okay bestie, gather round, because this is the manual page for Burp β the BackUp and Restore Program β straight outta the System Manager's Manual section 8. she's long, she's iconic, and she has OPINIONS. let's get into it π
πΈ NAME πΈ
Burp β BackUp and Restore Program. that's it. that's the name. it does exactly what it says on the tin, no cap.
π¦ SYNOPSIS π¦
burp [OPTIONS]
literally just burp and then whatever flags you feel like. slay.
π DESCRIPTION π
BackUp and Restore Program. yes bestie, that's the whole description, she's mysterious like that, we love a minimal queen π
π₯ SERVER OPTIONS π₯
these are the ones you use when you're running the server side, okay? pay attention.
-c[path] β short for "config file". the argument is a path to the config file. default is/etc/burp/burp.conf. (yes she said "short for 'config file'" and then gave you a flag that is also a letter, don't think about it too hard π)-Fβ Foreground mode. if you don't give this option, the server will fork into the background and run as a daemon. so like,-Fis the "stay here and hold my hand" flag π«Ά-gβ Generate initial CA keys and certificates, and then exit. one and done.-hβ Print help and then exit.-?β Print help and then exit. same energy, different punctuation.-iβ Print an index table of symbols that humans may see burp produce, and exit. yes the symbols have lore.-nβ No forking mode. the program will accept a single query, deal with it, and then exit. this is useful for debugging. implies-F. it's giving "one and done, no commitment" β¨-o[option=value] β Override a given option. you can use this flag several times to override multiple options. you can even reset list options with the special syntax:=(example:-o "include:=/tmp"). so much power in one tiny flag π-Qβ Do not log to stdout (overrides config filestdoutsetting).-tβ Dry-run mode to test config file syntax. vibe check your config before you commit, bestie.-vβ Log to stdout (overrides config filestdoutsetting).-Vβ Print version and exit.
β ADDITIONAL SERVER OPTIONS TO USE WITH -a c β
-C[client] β Run as if forked via a connection from this client. pretending to be somebody else, but legally π
π CLIENT OPTIONS π
now the client side, where the real drama lives.
-a[b|t|r|R|l|L|p|v|V|delete|e|T|d|D] β short for "action". the arguments mean backup, timed backup, restore, Restore, list, long list, parseable list, verify, Verify, delete, estimate, timer check, diff, or long diff, respectively. so many letters, so many destinies.-b[number|a] β short for "backup number". the argument is a number, orato select all backups. yes,ameans all. iconic.-c[path] β short for "config file". the argument is a path to the config file. the default is/etc/burp/burp.conf, or%PROGRAMFILES%\Burp\burp.confon Windows. cross-platform queen π-C[client] β Allows you to specify an alternative client to list or restore from. requires that the server configuration of the alternative client permits your client to do this. see therestore_clientandsuper_clientoptions. permission slip required, bestie.-d[path] β short for "directory". when restoring, the argument is a path to an alternative directory to restore to. when listing, the argument is the directory to list. dual purpose, multitasking main character energy.-fβ short for "force overwrite". without this option set, a restore will not overwrite existing files. be careful, this one goes feral π₯-hβ Print help and then exit.-?β Print help and then exit.-o[option=value] β Override a given option. you can use this flag several times to override multiple options. you can even reset list options with the special syntax:=(example:-o "include:=/tmp").-iβ Print an index table of symbols that humans may see burp produce, and exit.-q[max secs] β When running a timed backup, sleep for a random number of seconds (between 0 and the number given) before contacting the server. alternatively, this can be specified by therandomiseconfiguration file option. chaos, but make it scheduled β¨-Qβ Do not log to stdout (overrides config filestdoutsetting).-r[regex] β short for "regular expression". the argument is a case sensitive regular expression with which to match backup files. use it for lists, restores and verifies.-R[regex] β Case insensitive alternative to-r. same but louder and less picky.-s[number] β For use with restores β strip a number of leading path components. chopping off the front like a glow-up haircut.-tβ Dry-run mode to test config file syntax.-vβ Log to stdout (overrides config filestdoutsetting).-xβ On restore, do not use the Windows VSS API, and strip out the VSS data. works both on Windows and non-Windows.-X(Windows only) β On restore, do not use the Windows VSS API and do not attempt to strip out the VSS data. give this option when you are restoring a backup that contains no VSS data. only for the Windows girlies.-a sβ Run this to connect to a running server to get a live monitor of the status of all your backup clients. the live monitor requires ncurses support at compile time. live, laugh, monitor π-a Sβ Similar to-a s, but it prints the main status monitor summary screen to stdout. one application is that a script can run this and email an administrator the output on a cron job. this doesn't require ncurses support. there are additional options that can be given with both these options, listed below.
π ADDITIONAL CLIENT OPTIONS TO USE WITH -a s and -a S π
-C[client] β Limit the output to a single client.-b[number] β Show listable files in a particular backup (requires-C).-z[file] β Dump a particular log file in a backup (requires-Cand-b).-d[path] β Show a particular path in a backup (requires-Cand-b).-l[path] β Log file for status monitor β useful for debugging.
π ADDITIONAL CLIENT OPTIONS TO USE WITH -a b π
-o seed_src=<directory> -o seed_dst=<directory>β Make a seeding backup. the source directory is replaced with the destination directory on completion. both paths need to be absolute. your configured include paths need to be the same as the source directory, or within the source directory. there must be no other existing backups of the client running the seed job. a use case might be to make an initial backup of a local hard drive, and then to ship the hard drive to a remote location for subsequent backups. it's giving "sneakernet but make it glam" π¦
π EXAMPLES π
the part you actually came for, bestie. real commands, real vibes.
burp -a bβ Runs a backup.burp -a tβ Timed backup. the same asburp -a b, except that a script is run on the server before deciding to go ahead. the intention is that this command will be run on a repeating cron job with a short interval, and that the server will decide when it is time for a new backup. let the server be the decision-maker for once.burp -a lβ Lists the available backups and dates.burp -a l -b 1β Lists all the files in backup number 1.burp -a l -b aβ Lists all the files in all the backups.burp -a l -b cβ Lists all the files in the current backup.burp -a l -b 1 -r myregexβ Lists all the files in backup number 1 that match the regular expressionmyregex.burp -a L -b 1 -r myregexβ Long lists all the files in backup number 1 that match the regular expressionmyregex. this is like doing anls -l. fancy list mode β¨burp -a L -b 1 -d ''β Long list the top level directory of backup 1.burp -a L -b 1 -d '/home/graham'β Long list the/home/grahamdirectory of backup 1. these-dversions of the list function provide the ability to "browse" backups. it's giving file explorer, but make it terminal πburp -C altclient -a Lβ Long list the top level directory of backup 1 of clientaltclient.burp -a r -d /tmp/restoredirβ Restores all the files in the most recent backup into the directory/tmp/restoredir.burp -a r -b 1 -d /tmp/restoredir -r myregexβ Restores all the files in backup number 1 into the directory/tmp/restoredir, if they match the regular expressionmyregex.burp -a r -b 1 -d /tmp/restoredir -r myregex -s 2β Restores all the files in backup number 1 into the directory/tmp/restore, if they match the regular expressionmyregex, and strip 2 leading path components.burp -C altclient -a r -b 1 -d /tmp/restoredir -r myregexβ Restores all the files in backup number 1 of clientaltclientinto the directory/tmp/restoredir, if that match the regular expressionmyregex.burp -a vβ Verifies the most recent backup.burp -a v -b 1 -r myregexβ Verifies everything in backup number 1 that matches the regular expressionmyregex.burp -a delete -b 1β Deletes backup number 1. note that burp will not delete backup directories that other backup directories depend upon. she's protective like that π«Άburp -a d -b 1 -b 2β Report the differences between backups 1 and 2 (use-a Dfor more verbosity).burp -a p -b 1β Lists all the files in backup number 1, in burp-parsable list format. you may append something like>/tmp/restore_listto send to a file, edit, then use as an input for restoring. as in the following command:burp -a r -b 1 -o restore_list=/tmp/restore_listβ Restores from backup 7, matching the list of files given in/tmp/restore_list. the files given must be ordered as they would be in the output of a burp list command.burp -a p -b 6 | burp -a R -b 7β Restores from backup 7, matching the list of files on standard input, which is provided by burp's list of backup 6 (-a Ris shorthand for-a r -o restore_list=-).burp -a p -b 6 | burp -a V -b 7β Verifies from backup 7, matching the list of files on standard input, which is provided by burp's list of backup 6 (-a Vis shorthand for-a v -o restore_list=-).burp -a sβ Run the ncurses status monitor.burp -a Sβ Print a status monitor snapshot, summarising all clients.burp -C testclient -a Sβ Print a status monitor snapshot, showing clienttestclientonly.
π§ SERVER CONFIGURATION FILE OPTIONS π§
now we're in the config file, bestie. this is where you set the whole vibe.
.[glob] β Read additional configuration files. yes, the option name is literally a dot. she's minimalist πmode=serverβ Required to run in server mode. no mode=server, no server. periodt.listen=[address]:[port]β Defines the main TCP address and port that the server listens on. specify multiplelistenentries on separate lines in order to listen on multiple addresses and ports. each pair can be configured with its ownmax_childrenvalue.listen_status=[address]:[port]β Defines the main TCP address and port that the server listens on for status requests. specify multiplelisten_statusentries on separate lines in order to listen on multiple addresses and ports. each pair can be configured with its ownmax_status_childrenvalue. comment out to have no status server.network_allow=[string]β Allows access for the specified network or address. for example:::1or127.0.0.1/8. specify multiplenetwork_allowentries on separate lines to allow multiple networks or addresses. if this option is not given, all networks are allowed. this option can be overridden by the client configuration files inclientconfdiron the server.
β οΈ heads up bestie: that last line aboutnetwork_allowbeing overridden by client config files inclientconfdiron the server is IMPORTANT. don't forget it. also, "if this option is not given, all networks are allowed" β that's not a cute vibe, that's a wide open door, so pay attention π
okay we're only getting started, there's SO much more of this page and it keeps going, so stay with me π
network_allow_status=[string]β okay so this one lets a specific network or address get access to the status server. For example:'::1'or'127.0.0.1/8'. Specify multiplenetwork_allowentries on separate lines to allow multiple networks or addresses. If this option is not given, all networks are allowed. This option can be overridden by the client configuration files inclientconfdiron the server. πcname_lowercase=[0|1]β Whether to force lowercase cname when looking-up inclientconfdir. This also affects the fqdn lookup on the client (see client configuration options for details). The default is0. When set to1the name provided by the client while authenticating will be lowercased. β¨cname_fqdn=[0|1]β Whether to keep fqdn cname (like'testclient.example.com') when looking-up inclientconfdir. This also affects the fqdn lookup on the client (see client configuration options for details). The default is1. When set to0, the fqdn provided by the client while authenticating will be stripped ('testclient.example.com'becomes'testclient'). πdaemon=[0|1]β Whether to daemonise. The default is1. π¦fork=[0|1]β Whether to fork children. The default is1. πΈdirectory=[path]β Path to the directory in which to store backups. πdirectory_tree=[0|1]β When turned on (which is the default) and the client is on version1.3.6or greater, the structure of the storage directory will mimic that of the original filesystem on the client. π«Άtimestamp_format=[strftime format]β This allows you to tweak the format of the timestamps of individual backups. See'man strftime'to see available substitutions. If this option is unset, burp uses"%Y-%m-%d %H:%M:%S %z". πpassword_check=[0|1]β Allows you to turn client password checking on or off. The default is on. SSL certificates will still be checked if you turn passwords off. This option can be overridden by the client configuration files inclientconfdiron the server. π₯clientconfdir=[path]β Path to the directory that contains client configuration files. πlockfile=[path]β Path to the lockfile that ensures that two server processes cannot run simultaneously. πpidfile=[path]β Synonym forlockfile. βsyslog=[0|1]β Log to syslog. Defaults to off. πstdout=[0|1]β Log to stdout. Defaults to on. πkeep=[number]β Number of backups to keep. This can be overridden by theclientconfdirconfiguration files inclientconfdiron the server. Specify multiple'keep'entries on separate lines in order to keep multiple periods of backups. For example, assuming that you are doing a backup a day,keep=7keep=4keep=6(on separate lines) will keep 7 daily backups, 4 weekly backups (7x4=28), and 6 multiples of 4 weeks (7x4x6=168) - roughly 6 monthly backups. Effectively, you will be guaranteed to be able to restore up to168days ago, with the number of available backups exponentially decreasing as you go back in time to that point. In this example, every 7th backup will be hardlinked to allow burp to safely delete intermediate backups when necessary. You can have as many'keep'lines as you like, as long as they don't exceed52560000when multiplied together. That is, a backup every minute for 100 years. πmanual_delete=[path]β This can be overridden by theclientconfdirconfiguration files inclientconfdiron the server. When the server needs to delete old backups, or rubble left over from generating reverse patches withlibrsync=1, it will normally delete them in place. If you use the'manual_delete'option, the files will be moved to the path specified for deletion at a later point. You will then need to configure a cron job, or similar, to delete the files yourself. Do not specify a path that is not on the same filesystem as the client storage directory. π§hardlinked_archive=[0|1]β On the server, defines whether to keep hardlinked files in the backups, or whether to generate reverse deltas and delete the original files. Can be set to either0(off) or1(on). Disadvantage: More disk space will be used Advantage: Restores will be faster, and since no reverse deltas need to be generated, the time and effort the server needs at the end of a backup is reduced. πmax_hardlinks=[number]β On the server, the number of times that a single file can be hardlinked. Thebedupprogram also obeys this setting. The default is10000. πlibrsync=[0|1]β When set to0, delta differencing will not take place. That is, when a file changes, the server will request the whole new file. The default is1. This option can be overridden by the client configuration files inclientconfdiron the server. β¨librsync_max_size=[B/KB/MB/GB]β Only use librsync when a file is less than the given size. Both the most recently backed up version of a file and the version to be backed up are checked. The default is0, which means the option is off. This option can be overridden by the client configuration files inclientconfdiron the server. πcompression=zlib[0-9](orgzip[0-9]) β Choose the level of zlib compression for files stored in backups. Setting0orzlib0turns compression off. The default iszlib9. This option can be overridden by the client configuration files inclientconfdiron the server.'gzip'is a synonym of'zlib'. π¦hard_quota=[B/KB/MB/GB]β Do not back up the client if the estimated size of all files is greater than the specified size. Example:'hard_quota = 100GB'. Set to0(the default) to have no limit. πΈsoft_quota=[B/KB/MB/GB]β A warning will be issued when the estimated size of all files is greater than the specified size and smaller thanhard_quota. Example:'soft_quota = 95GB'. Set to0(the default) to have no warning. πversion_warn=[0|1]β When this is on, which is the default, a warning will be issued when the client version does not match the server version. This option can be overridden by the client configuration files inclientconfdiron the server. π«Άpath_length_warn=[0|1]β When this is on, which is the default, a warning will be issued when the client sends a path that is too long to replicate in the storage area tree structure. The file will still be saved in a numbered file outside of the tree structure, regardless of the setting of this option. This option can be overridden by the client configuration files inclientconfdiron the server. πclient_lockdir=[path]β Path to the directory in which to keep per-client lock files. By default, this is set to the path given by the'directory'option. π₯user=[username]β Run as a particular user. This can be overridden by the client configuration files inclientconfdiron the server. πgroup=[groupname]β Run as a particular group. This can be overridden by the client configuration files inclientconfdiron the server. πreadall=[0|1]β Keep readall capability when dropping root privileges (default0). When enabled changes default atime to1. βumask=[umask]β Set the file creation umask. Default is0022. πratelimit=[Mb/s]β Set the network send rate limit, in Mb/s. If this option is not given, burp will send data as fast as it can. If you want the server's sending speed to be limited, you will also need to set this option on the server side. πnetwork_timeout=[s]β Set the network timeout in seconds. If no data is sent or received over a period of this length, burp will give up. The default is7200seconds (2 hours). πworking_dir_recovery_method=[resume|delete]β This option tells the server what to do when it finds the working directory of an interrupted backup (perhaps somebody pulled the plug on the server, or something). This can be overridden by the client configurations files inclientconfdiron the server. Options are...delete: Just delete the old working directory.resume: Continue the previous backup from the point at which it left off. NOTE: If the client has changed its include/exclude configuration since the backup was interrupted, the recovery method will automatically switch to'delete'. See also the'resume attempts'option. π§
max_resume_attempts=[number]β Ifworking_dir_recovery_methodis'resume', this option tells the server how many times to attempt to resume before giving up and deleting the working directory. The default is0, which means to never give up. πclient_can_delete=[0|1]β Turn this off to prevent clients from deleting backups with the'-a delete'option. The default is that clients can delete backups. Restore clients can override this setting. πclient_can_diff=[0|1]β Turn this off to prevent clients from diffing backups with the'-a d'option. The default is that clients can diff backups. Restore clients can override this setting. β¨client_can_force_backup=[0|1]β Turn this off to prevent clients from forcing backups with the'-a b'option. Timed backups will still work. The default is that clients can force backups. πclient_can_list=[0|1]β Turn this off to prevent clients from listing backups with the'-a l'option. The default is that clients can list backups. Restore clients can override this setting. π¦client_can_monitor=[0|1]β Turn this off to prevent clients from being able to run the status monitor. The default is that clients can run the status monitor. Restore clients can override this setting. πΈclient_can_restore=[0|1]β Turn this off to prevent clients from initiating restores with the'-a r'option. The default is that clients can initiate restores. Restore clients can override this setting. πclient_can_verify=[0|1]β Turn this off to prevent clients from initiating a verify job with the'-a v'option. The default is that clients can initiate a verify job. Restore clients can override this setting. π«Άsuper_client=[client]β bestie, this one is the keys to the whole kingdom. Asuper_clientis allowed to list, verify, restore, delete, and diff files belonging to any other client β but only according to that super_client'sclient_canpermissions (like,client_can_list, yk). You can drop multiplesuper_clientlines, no cap. If that feels way too permissive (and honestly, it might), you can set asuper_clientfor individual original clients inside the individualclientconfdirfiles instead, or go look at therestore_clientoption. ποΈrestore_client=[client]β same energy assuper_client, but with β¨conditionsβ¨. Arestore_clientmay list, verify, restore, delete, and diff files belonging to any other client, but only according to theclient_canpermissions on both therestore_clientand the original_client (so, again, things likeclient_can_list). Multiplerestore_clientlines? Absolutely, go off. If that's still too permissive for your taste, set arestore_clientfor individual original clients in the individualclientconfdirfiles.ssl_cert_ca=[path]β the path to the SSL CA certificate. This file will probably be identical on both the server and the client (twins π). It should contain just the certificate in PEM format. For more on this, and the otherssl_*options, pls seedocs/burp_ca.txt.ssl_cert=[path]β the path to the server SSL certificate. It works for me when the file contains the concatenation of the certificate and private key in PEM format. π«Άssl_key=[path]β the path to the server SSL private key, in PEM format.ssl_key_password=[password]β only needed for loading an encrypted certificate. πssl_cert_password=[password]β synonym forssl_key_password. same thing, different name, we love a rebrand πssl_ciphers=[cipher list]β the allowed SSL ciphers. Seeopenssl ciphersfor the details.ssl_compression=zlib[0|5](orgzip[0|5]) β choose the level of zlib compression over SSL. Setting0orzlib0turns SSL compression off. Setting non-zero giveszlib5compression (it is not currently possible for openssl to set any other level, that's just the rules). The default is5. And'gzip'is a synonym of'zlib'β same vibe, different spelling.ssl_verify_peer_early=[0|1]β verify and authenticate client certificates at the SSL layer before receiving or sending any Burp traffic. The default is to verify client certificates only after password authentication. πssl_dhfile=[path]β path to the Diffie-Hellman parameter file. To generate one with openssl, use a command like this:
openssl dhparam -dsaparam -out dhfile.pem 2048
max_parallel_backups=[number]β defines the number of max parallel backups (aka the number of clients that are in a "working" state). The default is0β unlimited. π₯max_children=[number]β defines the number of child processes to fork (the number of clients that can simultaneously connect). The default is5. If you've configured multiplelistenentries, specify multiplemax_childrenentries on separate lines.max_status_children=[number]β defines the number of status child processes to fork (the number of status clients that can simultaneously connect). The default is5. If you've configured multiplelisten_statusentries, specify multiplemax_status_childrenentries on separate lines.max_storage_subdirs=[number]β defines the number of subdirectories in the data storage areas. The maximum number of subdirectories that ext3 allows is32000. If you don't set this option, it defaults to30000.timer_script=[path]β path to the script to run when a client connects with the timed backup option. If the script exits with code0, a backup will run. The first three arguments are the client name, the path to the'current'storage directory, and the path to the top level storage directories. The next two arguments are reserved, and user arguments (seetimer_arg) are appended after that. An example timer script is provided. Thetimer_scriptoption can be overridden by the client configuration files inclientconfdiron the server. If this option is not set, equivalent code internal to Burp will be run instead β and the internal code also uses thetimer_argparameters. β°timer_arg=[string]β a user-definable argument to the timer script. You can have many of these. Thetimer_argoptions can be overridden by the client configuration files inclientconfdiron the server.timer_repeat_interval=[m]β during a timed backup, the timer script can be run at regular intervals. If the client is out of timeband, the backup will be interrupted. For example, setting5will cause burp to check every five minutes. The default is0, which means the script will only run once, at the start of the backup.notify_success_script=[path]β path to the script to run when a backup succeeds. π User arguments are appended after the first six reserved arguments. An example notify script is provided. Thenotify_success_scriptoption can be overridden by the client configuration files inclientconfdiron the server.notify_success_arg=[string]β a user-definable argument to the notify success script. You can have many of these. Thenotify_success_argoptions can be overridden by the client configuration files inclientconfdiron the server.notify_success_warnings_only=[0|1]β set to1to send success notifications when there were warnings. If this andnotify_success_changes_onlyare not turned on, success notifications are always sent.notify_success_changes_only=[0|1]β set to1to send success notifications when there were new or changed files. If this andnotify_success_warnings_onlyare not turned on, success notifications are always sent.notify_failure_script=[path]β the same asnotify_success_script, but for backups that failed. πnotify_failure_arg=[string]β the same asnotify_success_arg, but for backups that failed.notify_failure_on_backup_with_failovers_left=[0|1]β in the case where there areserver_failoverentries left to try, you may not wish to notify on backup failure. The default is on.notify_failure_on_backup_working_dir_deletion=[0|1]β on the next backup attempt after a backup was interrupted, it may not be possible to resume the previous backup. In this case (or ifworking_dir_recovery_methodis'delete'), the previous backup will be deleted. You may wish to be notified about this. The default is off.
heads up bestie β that one's a real "your old backup is GONE gone" situation, so read it twice. π
dedup_group=[string]β enables you to group clients together for file deduplication purposes. For example, you might want to set'dedup_group=xp'for each Windows XP client, and then run thebedupprogram on a cron job every other day with the option'-g xp'.server_script_pre=[path]β path to a script to run on the server after each successfully authenticated connection but before any work is carried out. The arguments to it are'pre','(client command)','(client name)','(0 or 1 for success or failure)','(timer script exit code)', and then arguments defined byserver_script_pre_arg. If the script returns non-zero, the task asked for by the client will not be run. This command and related options can be overridden by the client configuration files inclientconfdiron the server.server_script_pre_arg=[string]β a user-definable argument to the server pre script. You can have many of these.server_script_pre_notify=[0|1]β turn on to send a notification email when the server pre script returns non-zero. The output of the script will be included in the email. The default is off. Most people will not want this turned on, because clients usually contact the server at 20 minute intervals and this could cause a lot of emails to be generated. Requires thenotify_failureoptions to be set. π§server_script_post=[path]β path to a script to run on the server before the client disconnects. The arguments to it are'post','(client command)','(client name)','(0 or 1 for success or failure)','(timer script exit code)', and then arguments defined byserver_script_post_arg. This command and related options can be overridden by the client configuration files inclientconfdiron the server.server_script_post_arg=[string]β a user-definable argument to the server post script. You can have many of these.server_script_post_notify=[0|1]β turn on to send a notification email when the server post script returns non-zero. The output of the script will be included in the email. The default is off. Requires thenotify_failureoptions to be set.server_script=[path]β you can use this to save space in your config file when you want to run the same server script twice. It overridesserver_script_preandserver_script_post. This command and related options can be overridden by the client configuration files inclientconfdiron the server. πserver_script_arg=[path]β goes withserver_scriptand overridesserver_script_pre_argandserver_script_post_arg.server_script_notify=[0|1]β turn on to send notifications email when the server pre and post scripts return non-zero. The output of the script will be included in the email. The default is off. Requires thenotify_failureoptions to be set.server_script_post_run_on_fail=[0|1]β if this is set to1,server_script_postwill always be run. The default is0, which means that if the task asked for by the client fails,server_script_postwill not be run.autoupgrade_dir=[path]β path to the autoupgrade directory from which upgrades are downloaded. The option can be left unset in order not to autoupgrade clients. Please seedocs/autoupgrade.txtin the source package for more help with this option. β¬οΈca_conf=[path]β path to the certificate authority configuration file. The CA configuration file will usually be/etc/burp/CA.cnf. The CA directory indicated byCA.cnfwill usually be/etc/burp/CA. Ifca_confis set and the CA directory does not exist, the server will create it, populate it, and the paths indicated byssl_cert_ca,ssl_cert,ssl_keyandssl_dhfilewill be overwritten. For more detailed information on this and the otherca_*options, please seedocs/burp_ca.txt. π
not me stressing thatssl_cert_ca,ssl_cert,ssl_keyandssl_dhfileget overwritten β yes, fr fr, that's what it says. β¨
ca_name=[name]β the name of the CA that the server is gonna generate when it's using theca_confoption. β¨ca_server_name=[name]β the name the server puts into its own SSL certs when it's usingca_conf. πca_burp_ca=[path]β path to theburp_cascript, but only when you're usingca_conf.ca_crl=[path]β overrides the default path to the certificate revocation list.ca_crl_check=[0|1]β do we check the certificate revocation list for revoked certs or not. Simple as that. πmonitor_browse_cache=[0|1]β should the server cache the directory tree while a monitor client is browsing? Pros: browsing goes zoom zoom fast. Cons: it eats more memory. Pick your fighter. πlabel=[string]β okay so you can have SO many of these, and they can be overridden in the client config files inclientconfdiron the server. They show up as an array of strings in the server status monitor JSON output. The whole idea is to give you a lil mechanism to pass arbitrary values to the clients of the server status monitor. cute, right? π¦enabled=[0|1]β set it to0to disable all the clients. Default is1. And yeah, this one can be overridden per-client in the client config files inclientconfdiron the server. πfail_on_warning=[0|1]β if a warning pops up during a backup, fail the whole backup. Default is0. Also overridable per-client in the client config files inclientconfdiron the server. π
πΈ CLIENT CONFIGURATION FILE OPTIONS πΈ
bestie this is the part where we make the client do stuff. let's go π
. [glob]β read additional config files. On Windows the glob is unimplemented so you'll have to name an actual file. no globbing for the Windows girlies, sorry πmode=clientβ required if you wanna run in client mode. non-negotiable.server=[host:port]β defines the server to connect to. If you don't drop a port in here, you're gonna need to specify it separately. β¨server_failover=[host:port]β defines a failover server to connect to, and yes you can stack more than oneserver_failoverentry. The client tries the next failover server if it can't connect to one. IMPORTANT: the burp client currently does not have the capability to have a different SSL profile for each server, so for this to actually work for you, you need the same CA and the same certs on every server. no cap.failover_on_backup_error=[0|1]β failover to the failover servers on backup errors too, not just on failures to connect. Default is off. πport=[port]β defines the TCP port on the server that we send requests to. If you set this one, it becomes the default for these options, and each of them can be overridden individually:port_backup,port_restore,port_verify,port_list,port_delete. If you don't set it, then you gotta set all of the port options separately. choose your struggle. πport_backup=[port]β the TCP port on the server we send backup requests to. If it's not set, it defaults to theportoption.port_restore=[port]β the TCP port on the server we send restore requests to. If it's not set, it defaults to theportoption.port_verify=[port]β the TCP port on the server we send verify requests to. If it's not set, it defaults to theport_restoreoption. (yes, restore. not port. iconic behaviour honestly π)port_list=[port]β the TCP port on the server we send list requests to. If it's not set, it defaults to theportoption.port_delete=[port]β the TCP port on the server we send delete requests to. If it's not set, it defaults to theportoption.status_port=[port]β defines the TCP port that the server is listening on for status requests.cname=[client name]β defines the client name you identify as to the server. your little nametag πcname_lowercase=[0|1]β whether to force a lowercasecnamewhen it's detecting thecnameautomatically (ie. when nocnamewas provided above). Default is0. When you set it to1, the name returned by theget_fqdnfunction gets lowercased. πcname_fqdn=[0|1]β whether to keep the fqdncname(liketestclient.example.com) when detecting thecnameautomatically (ie. when nocnamewas provided above). Default is1. When it's0, the fqdn returned by theget_fqdnfunction gets stripped, sotestclient.example.combecomestestclient. β¨password=[password]β defines the password to send to the server.enabled=[0|1]β set it to0to disable a client. Default is1. This one can also be set in the client configuration files inclientconfdiron the server.lockfile=[path]β path to the lockfile that makes sure two client processes can't run at the same time. (this currently doesn't work on Windows.) πpidfile=[path]β synonym forlockfile. same girl, different name.syslog=[0|1]β log to syslog. Defaults to off.stdout=[0|1]β log to stdout. Defaults to on.progress_counter=[0|1]β print progress counters on stdout. Defaults to on. πrandomise=[max secs]β when you're running a timed backup, sleep for a random number of seconds (somewhere between0and the number you give) before contacting the server. Or you can do it with the-qcommand line option instead. either way, you're vibing on a delay πΈuser=[username]β run as a particular user. (not supported on Windows.)group=[groupname]β run as a particular group. (not supported on Windows.)ratelimit=[Mb/s]β set the network send rate limit, in Mb/s. If you don't give this option, burp sends data as fast as it can, no chill whatsoever. And if you want the client's sending speed limited, you also need to set this option on the client side. πnetwork_timeout=[s]β set the network timeout in seconds. If literally no data gets sent or received over a period this long, burp gives up. Default is7200seconds (that's 2 hours, bestie). π΄ca_burp_ca=[path]β path to theburp_cascript (burp_ca.baton Windows). For more info on this, go peek atdocs/burp_ca.txt. πca_csr_dir=[path]β the directory where certificate signing requests get generated. For more info on this, go peek atdocs/burp_ca.txt.ssl_cert_ca=[path]β the path to the SSL CA certificate. This file is probably the same on both the server and the client. It should contain just the certificate in PEM format. For more info on this and the otherssl_*options, go peek atdocs/burp_ca.txt. πssl_cert=[path]β the path to the client SSL certificate. It works for me when the file contains the concatenation of the certificate and the private key in PEM format. (the manpage really said "works for me" and honestly? respect.) πssl_key=[path]β the path to the client SSL private key in PEM format.ssl_key_password=[password]β only needed for loading an encrypted certificate.ssl_cert_password=[password]β synonym forssl_key_password.ssl_peer_cn=[string]β must match the common name in the SSL certificate that the server gives when it connects. Ifssl_peer_cnis not set, the server name gets used instead.ssl_ciphers=[cipher list]β allowed SSL ciphers. Go seeopenssl ciphersfor the details. π§server_can_override_includes=[0|1]β to stop the server from being able to override your local include/exclude list, set this to0. Default is1.server_can_restore=[0|1]β to stop the server from initiating restores, set this to0. Default is1. You'll also need to give a location for the files to be restored to with therestoreprefixoption. πrestoreprefix=[path]β when restoring, this path gets prefixed to the restore path. The-dcommand line option overrides this setting. And this setting is required if you're using server initiated restores.encryption_password=[password]β set this to enable client side file AES-CBC-256 encryption. If you don't want encryption, just leave this field out of your config file.
IMPORTANT: configuring an encryption_password renders delta differencing pointless, because the smallest real change to a file makes the whole file look different. So activating this option turns off delta differencing, which means whenever a client file changes, the whole new file gets uploaded on the next backup. ALSO IMPORTANT: if you manage to lose your encryption password, you will not be able to unencrypt your files. So you should think about having a copy of the encryption password somewhere off-box, in case your client hard disk fails. Take care when copying and pasting special characters between client conf files, because the encoding of the config file matters. π FINALLY: if you change your encryption password, you'll end up with a mixture of files on the server with different encryption and it may get tricky to restore more than one file at a time. For this reason, if you change your encryption password, you may want to start a fresh chain of backups (by moving the original set aside, for example). Burp will cope fine with turning the same encryption password on and off between backups, and will restore a backup of mixed encrypted and unencrypted files without a problem. β¨
glob_after_script_pre=[0|1]β set this to0if you don't want theinclude_globsettings to be evaluated after the pre script is run. Default is1.backup_script_pre=[path]β path to a script to run before a backup. It is not run if the server decides it's not yet time for a backup. The arguments to it are'pre','reserved2'to'reserved5', and then the arguments defined bybackup_script_pre_argβ unless the optionbackup_script_reserved_argsis off, in which case only the arguments defined bybackup_script_pre_argget passed to it. If the script fails (ie. when the return code is not0), then the backup is aborted. no second chances πbackup_script_pre_arg=[string]β a user-definable argument to the backup pre script. You can have many of these. stack 'em up πbackup_script_post=[path]β path to a script to run after a backup. The arguments to it are'post',[0|1]depending on whether the backup failed or succeeded,'reserved3'to'reserved5', and then the arguments defined bybackup_script_post_argβ unless the optionbackup_script_reserved_argsis off, in which case only the arguments defined bybackup_script_post_argget passed to it. πbackup_script_post_arg=[string]β a lil argument you get to define yourself, passed to the backup post script. And bestie, you can have many of these. Stack 'em up πbackup_script_post_run_on_fail=[0|1]β set this to1andbackup_script_postruns no matter what, win or lose. Default is0, which meansbackup_script_postonly runs if the backup actually succeeds. So if you're the type who wants the tea even when things flop, flip it to1π«Άrestore_script_pre=[path]β path to a script that runs before a restore. What gets handed to it? The arguments'pre','reserved2'to'reserved5', and then whatever you defined withrestore_script_pre_argβ unless the option'restore_script_reserved_args'is off, in which case only the args defined byrestore_script_pre_argget passed along. okay so it's giving "surprise, extra args" but only sometimes β¨restore_script_pre_arg=[string]β a user-definable argument for the restore pre script. Yes, you can have many. Collect them like stickers πΈrestore_script_post=[path]β path to a script that runs after a restore. Its arguments are'post', then[0|1]depending on whether the restore failed or succeeded, then'reserved3'to'reserved5', and then the args you defined withrestore_script_post_argβ unless'restore_script_reserved_args'is off, in which case only yourrestore_script_post_argargs show up. same energy as the pre one, just post πrestore_script_post_arg=[string]β a user-definable argument for the restore post script. Many of these allowed, as per usual πrestore_script_post_run_on_fail=[0|1]β set to1andrestore_script_postruns whether the restore succeeds or not. Default0means it only runs if the restore succeeds. no cap.backup_script=[path]β this one's the space-saver. When you want the same script to run before and after a backup, use this instead of writing it twice. It overridesbackup_script_preandbackup_script_post. iconic efficiency πbackup_script_arg=[path]β the buddy ofbackup_script. It overridesbackup_script_pre_argandbackup_script_post_arg. yes it's literally labeled[path]in the original and yes we're keeping it exactly like that, don't come for me πbackup_script_reserved_args=[0|1]β whether to pass reserved arguments to backup scripts. Default is on.restore_script=[path]β same trick, but for restores. Want one script doing both the before and the after? Use this, it saves you config-file lines. It overridesrestore_script_preandrestore_script_postπ¦restore_script_arg=[path]β goes withrestore_script, and overridesrestore_script_pre_argandrestore_script_post_arg.restore_script_reserved_args=[0|1]β whether to pass reserved arguments to restore scripts. Default is on.
autoupgrade_dir=[path]β path to the autoupgrade directory, aka where the upgrades get downloaded to. There's more help on this whole situation indocs/autoupgrade.txtin the source package, so go read that if you're curious. And listen: if you do not want your client to autoupgrade, then just don't set this option. periodt π«autoupgrade_os=[string]β the name of the client operating system. It should match a directory name inside the server'sautoupgrade_dir. And again β if you don't want your client autoupgrading, don't set this one either πmonitor_exe=[path]β tells burp where to look for theburpbinary when it's forking a monitor client. You might genuinely need this on systems that have no sensible way for a process to figure out its own path β likeopenbsd. sometimes a girl just doesn't know where she lives π
π INCLUDES / EXCLUDES π
Okay bestie, this is the part where you tell burp exactly what you want in your backup and what you want it to leave alone. These options can come from the client, but heads up: if you put at least one include= or include_glob= in the client configuration files over on the server, the server will override them all. The server said "I'm the main character now." π
include=[path]β the path you want in the backup, queen. You can have multiple include lines, so go off. Use forward slashes/, not backslashes\, as path delimiters.exclude=[path]β the path you want excluded from the backup. Multiple exclude lines? Absolutely allowed. And again: forward slashes/, not backslashes\.include_glob=[glob expression]β include paths that match the glob expression. Like,/home/*/Documentswill include/home/user1/Documentsand/home/user2/Documentsif directoriesuser1anduser2exist in/home. So satisfying. β¨ The Windows implementation currently limits the expression to contain only one*, with one exception β you may also specify*:to expand to detected fixed drives.include_regex=[regular expression]β include paths that match the regular expression. You need at least oneincludeorinclude_globoption so there are actually files to be matched against the regex (no starting point = nothing to match, bestie). And if you have at least oneinclude_regexline, then any path NOT matching the regex will be excluded from your backup. That's just how it is. π«Άexclude_regex=[regular expression]β exclude paths that match the regular expression. Simple. Clean. Iconic.include_logic=[logic expression]β not yet implemented. Seeexclude_logicfor details on thelogic expressionsyntax. (Someday, babe. Someday. π)exclude_logic=[logic expression]β exclude paths that match thelogic expression. So what even is alogic expression? It may contain several tests chained with boolean operators. The supported operators are:and,or,not, as well as groups of expressions surrounded by parentheses. The supported tests are:file_size,file_match,path_matchandfile_ext.- The
file_sizetest supports comparisons with>,>=,<,<=,=and takes a size as parameter, example:file_size<=5Mb. - The
file_exttest takes an extension as parameter, example:file_ext=pst. - Finally, the
file_matchandpath_matchtests take a regular expression as parameter, example:file_match=b$.file_matchis ran against the filename (examplefile1) whilepath_matchis ran against the full path of the file (example:/home/test/file1).
- The
A complete expression may look like:
(file_size>=5Mb and file_size<=10Mb) and (file_ext=pst or file_match=movies) and not file_ext=mp3
There are some limitations though β white-spaces and parentheses must be escaped inside a test either by quoting the expression or escaping a given character: file_match="perso(nnal)?", file_match=a filename.
include_ext=[extension]β extensions to include in the backup. Case insensitive, naturally. Nothing else will be included in the backup. You can have multiple include extension lines. For example, settxtto include files that end in.txt. And you need to specify anincludeline so that burp knows where to start looking β it's not psychic, bestie.exclude_ext=[extension]β extensions to exclude from the backup. Case insensitive. Multiple exclude extension lines welcome. For example, setvdito exclude VirtualBox disk images.exclude_comp=[extension]β extensions to exclude from compression. Case insensitive. You can have multiple exclude compression lines. For example, setgzto exclude gzipped files from compression (why compress what's already compressed, right?).exclude_fs=[fstype]β file systems to exclude from the backup. Case insensitive. You can have multiple exclude file system lines. For example, settmpfsto exclude tmpfs. Burp has an internal mapping of file system names to file system IDs, so if you know the file system ID, you can use that instead β for example,exclude_fs = 0x01021994will also exclude tmpfs. Slay.include_fs=[fstype]β file systems to include into the backup. Case insensitive. Multiple include file system lines are fine. For example, setext4to include ext4. Burp has an internal mapping of file system names to file system IDs β if you know the file system ID, you can use that instead. For example,include_fs = 0x01021994will also include tmpfs. If at least one file system is included, all other filesystems will be excluded per default. Included directories that do not live on an included file system will be skipped, even ifcross_all_filesystemsis enabled and they contain subdirectories with included file systems. Read that one twice, bestie. π¦
Note that on SunOS systems include_fs and exclude_fs will do a case sensitive compare of the string descriptors of the file systems instead of the numeric IDs (see f_basetype member is struct statvfs).
min_file_size=[B/KB/MB/GB]β do not back up files that are less than the specified size. Example:min_file_size = 10MB. Set to0(the default) to have no limit.max_file_size=[B/KB/MB/GB]β do not back up files that are greater than the specified size. Example:max_file_size = 10MB. Set to0(the default) to have no limit.cross_filesystem=[path]β allow backups to cross a particular filesystem mountpoint. You picked one, you brave thing. πͺcross_all_filesystems=[0|1]β allow backups to cross all filesystem mountpoints. Go everywhere. No cap.nobackup=[file name]β if this file system entry exists, the content of the directory containing it will not be backed up. A little "do not disturb" sign for a whole directory. πread_fifo=[path]β do not back up the given fifo itself, but open it for reading and back up the contents as if it were a regular file.read_all_fifos=[0|1]β open all fifos for reading and back up the contents as if they were regular files. All of them. Every single one.read_blockdev=[path]β do not back up the given block device itself, but open it for reading and back up the contents as if it were a regular file.read_all_blockdevs=[0|1]β open all block devices for reading and back up the contents as if they were regular files.split_vss=[0|1]β when backing up Windows computers, this option allows you to save the VSS header data separate from the file data. The default is off, which means that the VSS header data is saved prepended to the file data.strip_vss=[0|1]β when backing up Windows computers, this option allows you to prevent the VSS header data being backed up. The default is off. To restore a backup that has no VSS information on Windows, you need to give the client the-xcommand line option. Important little detail, don't forget it. β¨vss_drives=[list of drive letters]β when backing up Windows computers, this option allows you to specify which drives have VSS snapshots taken of them. If you omit this option, burp will automatically decide based on theincludeoptions. If you want no drives to have snapshots taken of them, you can specify0.acl=[0|1]β if acl support is compiled into burp, this allows you to decide whether or not to backup acls at runtime. The default is1.xattr=[0|1]β if xattr support is compiled into burp, this allows you to decide whether or not to backup xattrs at runtime. The default is1.atime=[0|1]β this allows you to control whether the client usesO_NOATIMEwhen opening files and directories. The default is0, which enablesO_NOATIME. This means that the client can read files and directories without updating the access times. However, this is only possible if you are running as root, or are the owner of the file or directory. If this is not the case (perhaps you only have group or world access to the files), you will get errors until you setatime=1. Withatime=1, the access times will be updated on the files and directories that get backed up.scan_problem_raises_error=[0|1]β when enabled, this causes problems in the phase1 scan (such as anincludebeing missing) to be treated as fatal errors. The default is off.
ποΈ SERVER CLIENTCONFDIR FILE ποΈ
So how does the server even know about the clients that are allowed to contact it? Bestie, you place a file named after the client in clientconfdir. That's the vibe.
- Files beginning with
.or ending with~are ignored. - Directories are also ignored. Bye. πͺ
The file name must match the name in the cname field on the client. Like a matching friendship bracelet but for auth. π
ssl_peer_cn=[string] must match the common name in the SSL certificate that the client gives when it connects. If ssl_peer_cn is not set, the client name will be used instead (the clientconfdir file name).
The file needs to contain a line like password=[password] that matches the same field on the client, or passwd=[hash] β where the plain text password on the client will be tested against a hash of the kind you might find in /etc/passwd.
Additionally, the following options can be overridden here for each client (yes, per client, very customizable of you π):
client_can_deleteclient_can_force_backupclient_can_listclient_can_monitorclient_can_restoreclient_can_verifyclient_lockdircompressiondedup_groupdirectorydirectory_treeenabledfail_on_warninghard_quotakeeplabellibrsynclibrsync_max_sizemanual_deletenetwork_allownetwork_allow_statusnotify_failure_argnotify_failure_on_backup_with_failovers_leftnotify_failure_on_backup_working_dir_deletionnotify_failure_scriptnotify_success_argnotify_success_scriptnotify_success_warnings_onlypassword_checkpath_length_warnrblk_memory_maxrestore_clientserver_script_argserver_scriptserver_script_notifyserver_script_post_argserver_script_postserver_script_post_notifyserver_script_post_run_on_failserver_script_pre_argserver_script_preserver_script_pre_notifysoft_quotasuper_clientsyslogtimer_argtimer_repeat_intervaltimer_scripttimestamp_formatversion_warnworking_dir_recovery_method
Additionally, the includes and excludes can be overridden here, as described in the section above. (Yeah, we just talked about them. Go scroll up, bestie. π)
And as with the other configuration files, extra configuration can be included with the . path/to/config/file syntax. Chain those configs, it's giving modular. π
π Some notes on SSL certificates π
Okay so the burp example configs come with example SSL certificates and keys. You can use these and burp will work. But if you're worried about network security, bestie, you should generate your own certificates and keys and point your config files to them. To create the example files, the author used a handy interface to openssl called tinyca (http://tinyca.sm-zone.net/). If you're on Debian, you can run apt-get install tinyca to get it. There's also the option of using burp_ca, which you can find in the source distribution, courtesy of Patrick Koppen. π
πΈ Examining backups πΈ
As well as using the client list options described above, you can go directly to the storage directory on the server. The backups for a client are in the directory named after the client. Inside each backup directory is a file called manifest.gz.
This contains a list of all the files in the backup, and where they originally came from on the client.
There's also a log.gz file in the backup directory, which contains the output generated by the server during the backup.
The data directory contains complete backup files.
The deltas.reverse directory contains reverse deltas that can be applied to the data from the next backup in the sequence (indicated by the contents of the forward file).
Anything with a .gz suffix is compressed in zlib (gzip) format. You can use standard tools, such as zcat, zless or cp, to view them or copy them elsewhere. Files from Windows backups will probably contain VSS headers and/or footers. For help stripping these, see the vss_strip man page. π¦
π Server initiated backups π
You can queue a backup on the server, to be performed when the client next makes contact. To do this, you put a file called backup into the top level of the client storage directory. The contents of the file are ignored. π
π Server initiated restores π
You can queue a restore on the server, to be performed when the client next makes contact. To do this, you put a file called restore into the top level of the client storage directory. The client can deny server initiated restores by setting "server_can_restore=0" in its burp.conf. The client also needs to specify 'restoreprefix' in its configuration as a destination for the restored files. Valid fields to include in the restore file are:
orig_client=[client]β The original client to restore from. Equivalent to-Cwhen initiating a restore from a client. Do not include this line when restoring to the original client. See also therestore_clientandsuper_clientserver options.backup=[number|a]β The number of the backup to restore from. Equivalent to-bwhen initiating a restore from the client.overwrite=[0|1]β Whether to overwrite existing files. Equivalent to-fwhen initiating a restore from the client.strip=[number]β Number of leading path components to strip. Equivalent to-swhen initiating a restore from the client.restoreprefix=[path]β Appended to the client-siderestoreprefixsetting, and then prefixed to the restore path.stripfrompath=[string]β Strip matching string from restore paths (before prefix is prepended).regex=[regular expression]β Only restore files matching the regular expression. Equivalent to-rwhen initiating a restore from the client.include=[path]β Restore directories and files that match the path. If it is a directory, the contents of the directory will be restored. You can have multipleincludelines. There is no equivalent when initiating a restore from the client.
π¨ SIGNALS π¨
Sending signal 1 (HUP) to the main server process will cause it to reload. For the vast majority of configuration changes, a reload is unnecessary as the server will pick up changes "on-the-fly". Sending signal 12 (USR2) to the main server process will cause it to wait until there are no longer any child processes, and then exit. The intention is to help with upgrades without interrupting current backups. if you are running upstart, a new burp server process will start up when the old one exits. π
π― RETURN CODES (SERVER) π―
0: success1: error
π― RETURN CODES (CLIENT) π―
0: success1: error2: restore gave warnings3: timer conditions on the server were not met4: could not connect to server5: max parallel backups reached
π BUGS π
If you find bugs, please report them to the email list. See the website http://burp.grke.net/ for details.
π AUTHOR π
The main author of Burp is Graham Keeling.
βοΈ COPYRIGHT βοΈ
See the LICENCE file included with the source distribution.
And that's the footer, bestie: Burp, Burp(8) β source/version and date as the manpage says. Stay iconic. πβ¨
π¦ where this page comes from
- debian bookworm: burp 3.1.4-1 Β· AGPL-3.0-only
- debian trixie: burp 3.1.4-4 Β· AGPL-3.0-only
- nixpkgs unstable: burp 3.2.0
- ubuntu noble: burp 3.1.4-3.1build3 Β· AGPL-3.0-only
- ubuntu questing: burp 3.1.4-4
- ubuntu resolute: burp 3.1.4-5 Β· AGPL-3.0-only
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms