bksh

Download: bksh-1.7.tar.gz (20k)
MD5: 7823853962c0017de9d40e165a9cb913

This is a backup tool I wrote not too long ago to work around backup limitations. The problem was the following: given a secure machine with close to no free disk space, how to proceed with a secure backup without giving a full login shell on the backup server?

This might seem simple to solve, but it is not. You can't just give out ftp access, since it's insecure (sniffable). HTTP is also out since you'd have to write another web-based application.

I decided to write a "shell", in C, and I called it bksh. What it does is pretty simple, it reads a file from standard input and writes it to a (compile-time restricted) directory. The files are separated each in a private directory named to the client's IP address (taken from ssh's SSH_CLIENT environment), so client can't overwrite each other's backups. A filename can be specified as a shell argument. If the filename is already taken, the files are rotated in a manner similar to newsyslog(8). The number of rotated files can be compiled-in or configurable on the command line.

bksh is also really small. With a distro of 18k and around 400 lines of code, it compiles a binary of 8k.

I think it's a very secure and useful program, but it hasn't been audited properly, so I offer no guarantee. As always, use at your own risk.

For installation and usage instructions, you can read the current README from cvsweb, but it's also included in the tarball.

bksh has been developed and tested on FreeBSD 4.x-stable but also compiles on Debian GNU/Linux. It has not been tested on any platform but FreeBSD yet. Please share your experiences, I'm curious to know if it works everywhere as I think it would.