VMcom Administrator Guide BACKUP APPLIANCE VMcom LLC. All rights reserved.

Transcription

1 VMcom Administrator Guide BACKUP APPLIANCE VMcom LLC. All rights reserved.

2 Index Overview 4 About VMcom Backup Appliance 4 Solution Architecture 4 Multitenancy 4 Installation 5 Deploy Virtual Appliance 5 Adjust Virtual Hardware 5 Manual Network Settings 5 First Login 6 Backup Jobs 7 Create Backup Job 7 Edit Backup Job 7 Delete Backup Job 7 Restore Operations 8 Browse Backups 8 Restore Individual Files 8 Restore Entire VM 8 Restore VM into a New Location 9 Tenants 10 About Tenants 10 Suggested Concepts 10 Tenant Users Login 10 Create Tenant 11 Edit Tenant 11 Delete Tenant 11 User Settings 12 Password Change 12 Reporting 12 Log Out 12 System Settings 13 Mailserver 13 Updating VMcom Backup Appliance 13 Licensing 13 Configuration Backup 14 Configuration Restore 14 Requesting Support 15 2

3 LDAP Integration 16 Add LDAP Server 16 Tenant Users and Groups 16 System Users and Groups 16 Advanced Configuration 17 Console Login 17 Change SSL Certificate 17 Revert SSL Certificate Changes 18 Change Time Zone 18 Change IP Address 18 3

4 Overview About VMcom Backup Appliance VMcom Backup Appliance is a pre-installed virtual machine designed to back up and recover VMware VMs. It is distributed as an Open Virtualization Appliance (OVA), which makes it supremely easy to deploy into an existing vsphere environment. All required components are already built-in and available out-of-the-box. VMcom leverages enterprise-grade open source software and does not require any additional licenses for its functionality. Solution Architecture In a basic deployment scenario, all components are installed on a single linux-based virtual machine (VM). The VM itself can be deployed onto a dedicated ESXi host (including ESXi free edition) or into an existing vsphere cluster. VMcom can utilize any datastore connected to its host, including local disks, NFS storage, iscsi target, etc. Thanks to built-in LZ4 compression and transparent deduplication, any server capable of running the ESXi hypervisor can become a fully functional deduplicated backup solution at no additional costs. VMcom Backup Appliance consists of the following components: VMware Infrastructure manager Backup Storage manager Users and Tenants manager Backup Job manager Detailed description of all of the components can be found in subsequent chapters. Multitenancy Coming from an ISP background, the VMcom Backup Appliance is highly multitenant. It enables the central administrator to create isolated (tenant) environments within a single appliance. Each tenant can then be assigned a set of permissions on selected vsphere objects (VMs, folders, resource pools, etc.) and a storage quota. Backup and restore operations can be delegated to tenant users while maintaining a single pane of glass interface for VMcom administrators. This arrangement is extremely useful in environments where multiple teams or even organizations share the same underlying hardware. 4

5 Installation Deploy Virtual Appliance Use your vsphere client to deploy the OVA template you obtained from VMcom website. During this process, you will be asked to enter basic setting for the primary network interface card (NIC). If your environment requires more than one NIC, at this point please enter setting for the interface that will serve as default gateway. Additional NICs can be created later. Please note that vcenter Server is required for automated network setup. If you re deploying directly onto a standalone ESXi host, manual intervention will be required kindly refer to the following chapters. Adjust Virtual Hardware After the deployment process has finished, edit settings of the newly created virtual machine. If you wish to utilize VMcom host server s local disks for storing backups, expand Hard disk 2 (which serves as a default storage target) to desired size, or add more virtual disks. For best performance, it is recommended to add a small SSD-backed virtual disk per each large backup disk. Fast, small drives can boost deduplication speed significantly. When adding new virtual disks for backups or cache, change their mode to Independent Persistent. This setting will help with future backups of the appliance itself. You can also scale the number of virtual CPUs and memory here. Suggested default values are suitable for small environments of up to 5 hosts. Lastly, add more NICs if necessary and connect them into appropriate networks. Additional NICs are typically connected to ESXi management subnets, whereas the primary NIC is a public facing interface. After this step is complete, power on the VMcom Backup Appliance VM. Manual Network Settings If you deploy the appliance using a vcenter Server and do not require more than one NIC, you can safely skip this chapter. Otherwise please refer to the Console Login chapter near the end of this guide and log in to appliance s shell. Individual NICs settings can be adjusted simply by using the following commands. # set up the primary NIC eth0 sudo /opt/vmba/bash/manual-network-settings.sh eth0 <ip> <mask> <gateway> <dns1> <dns2> # set up the first additional NIC eth1 sudo /opt/vmba/bash/manual-network-settings.sh eth1 <ip> <mask> # example for eth1 with IP /24 and an optional route to /8 via sudo /opt/vmba/bash/manual-network-settings.sh eth / It is highly recommended to verify the new settings using the ping command after each change. 5

6 First Login Direct your web browser to and accept the End User License Agreement (EULA). Then log in as admin with password pleasechangeme. Select VMware Infrastructure item in the left menu. Click Add vcenter Server button and enter your vcenter s hostname and credentials. It is recommended to create a separate vsphere user with following minimal privileges for the appliance. Datastore -> Allocate space Datastore -> Browse datastore Datastore -> Low level file operations Datastore -> Update virtual machine files Global -> Licenses Global -> Disable methods Global -> Enable methods Network -> Assign network Resource -> Assign VM to resource pool Virtual Machine -> Configuration Virtual Machine -> Inventory -> Create new Virtual Machine -> Provisioning Virtual Machine -> Snapshot management If the operation was successful, the appliance will obtain vsphere host s SSH fingerprint and cache its inventory for faster browsing. The cache will refresh automatically every 20 minutes. You can add multiple vcenters or standalone ESXi hosts here. Minimal required vsphere version is 4.1 or newer. Please note that ESXi Free edition is not supported as backup source. Next, select the Backup Storage menu item. Use the Create button to turn virtual disks added in previous chapter into deduplicated backup targets. If you ve added some SSD disks for caching, mark the appropriate disk as Deduplication cache disk when creating the backup target. Alternatively, you can use SMB / NFS network shares for storing backups. Add a network share by clicking one of the Add NFS Share or Add SMB Share buttons near the top of the screen. This option also enables seamless integration of the VMcom Backup Appliance with third party deduplication appliances. Lastly, click My Settings and change your admin password. You are now ready to create your first backup job. 6

7 Backup Jobs Create Backup Job Select the Backup Jobs menu item. Click Create vsphere Job button, fill-in Job Name, select source vsphere Host and confirm with OK. A new backup job will appear in the overview. Expand detailed view by clicking on Open button in the Actions column. Add one or more vsphere Objects that will be protected by this job. You can check individual virtual machines in this job in the Protected VMs panel. Next, add a Target Storage that will be used for storing backups. You can add multiple storage targets here, however only the most recently added storage will be marked as Primary target. This arrangement enables the possibility of changing the Primary target in the future without losing backups stored on previous targets. At this point, your backup job is ready. You can run it manually by clicking the Run now button or schedule automated backups with the Edit schedule button. Edit Backup Job Backup job name and description can be modified simply by clicking the Edit button in the Actions column of the overview table. To modify job s detailed setting, expand the job using the Open button. Adding or removing Selected Objects will affect only future backups. Existing backups will remain unchanged. Removing Target Storage from job will also delete any job s backups stored on the storage, thus freeing disk space. If you wish to merely choose a new storage for future backups while keeping the old ones, simply add a new Target Storage without removing the previous one. Delete Backup Job Backup jobs can be removed using the Delete button in the Actions column. Deleting a backup job also deletes all backups created by this job and thus freeing disk space. If you wish to keep old backups but prevent creating new ones, simply edit the job s scheduler to Never run automatically. 7

8 Restore Operations Browse Backups Select the Browse Backups left menu item. You will see individual virtual machines with available backups. Expand selected virtual machine by clicking the Browse button in the Action column. Next, select a restore point from the list and display its content using the right arrow button. A list of virtual disks will appear. Restore Individual Files Navigate to virtual disk you wish to restore from (see Browse Backups). Click the Browse files button next to the selected virtual disk. A file tree will appear. Select one or more items to restore and click Download selected. By performing these steps, you will create a ZIP archive which will be available for download for 24 hours. Creating the archive can be a time consuming operation and you may want to come back later. If you need to restore a large amount of data, consider restoring the entire virtual machine into a new location (Admin role required). Please note that browsing the file tree requires the virtual disk to contain a valid partition table and healthy file system. Failing to display the file tree does not mean that the backup is corrupted. Full VM restore can still be performed, as full restores are performed on block level, independent on the file system used. Restore Entire VM Only the VM Restore Operator, Tenant Admin or Admin user roles can perform this task. Restoring entire virtual machine into its original location requires the source virtual machine to be powered off before starting the restore operation. This arrangement helps to prevent accidental outages or data loss. As the very first step of the restore process, current VM state is saved into a snapshot which will be kept for 72 hours. During this time, you can safely revert the restore process using the vsphere snapshot manager. Navigate VMcom appliance to a restore point you wish to reinstate (see Browse Backups) and click the Restore entire VM button. Confirm the dialog by clicking OK. After the restore process has finished, use vsphere client to power-on the VM. Please note that this action is not available for partial backups. 8

9 Restore VM into a New Location This operation creates a new virtual machine based on original configuration and virtual disks. Since unlimited scope of the vsphere inventory is required, only non-tenant users with Admin or VM Restore Operator roles can perform this task. It is possible to restore VMs onto any vcenter or ESXi Host in your VMware Infrastructure. If you combine multiple vsphere versions, please verify that VM s virtual hardware will be supported on the target host. Navigate VMcom appliance to a restore point you wish to reinstate (see Browse Backups). Click the Restore VM into a new location button. Enter new placement data and confirm the dialog by clicking OK. After the restore process has finished, use vsphere client to power on the VM. As the newly created VM is an exact copy of the original VM, it is safe to answer I copied this VM if vsphere asks. 9

10 Tenants About Tenants In traditional backup applications, all users can see all virtual machines in the entire vsphere inventory. This arrangement often makes it impossible for administrators to provide a self-service backup and recovery portal for non-admin users. VMcom addresses this issue with the concept of tenants. Tenants are isolated environments with separate users and limited scope of the vsphere inventory. In a typical case, each tenant would correspond to a vsphere user or LDAP group. Just as vsphere enables delegation of simple tasks (guest reboot, console access) to VM owners, VMcom provides the same level of functionality for backup operations. Using the tenants feature is optional but highly recommended. Suggested Concepts Depending on your use-case, tenant users can have different levels of autonomy. Please compare the following concepts to determine user roles that match your environment. Self-Service Recovery Only Keep all responsibility with central administrator. Backup jobs managed by trained professionals. Suggested tenant user roles: File Restore Operator (safest) VM Restore Operator Keep tenants quotas sufficiently high to prevent them interfering with regular backups. Self-Service Backup and Recovery Delegate all responsibilities to tenants. Useful for skilled tenants who benefit from advanced features like backup-on-demand, etc. Suggested tenant user role: Tenant Admin Backup quotas typically match service levels established by a tenant contract. Tenant Users Login Please note that user names are not unique across tenants. VMcom Backup Appliance deals with this issue by assigning each tenant a different URL. This concept is similar to VMware vcloud Director organizations. Assume that non-tenant users log in at: Tenant with name Customer 1 will then be able to log in using the following URLs: 1/ 1/ Use of alphanumeric characters, hyphen and underscore only in tenant names is therefore recommended. 10

11 Create Tenant Select Users & Tenants left menu item (Admin role required). Click the Add Local Tenant button, enter tenant name and confirm with OK. Tenant name will become a part of URL address used by Tenant Users to log in. Please refer to the Tenants chapter for more details on this topic. A new tenant will appear in the overview. Expand a detailed view by clicking the Open button in the Actions column. Add one or more Managed Objects into tenant s scope. Managed object can be any vsphere object, including vdcs, Folders, Virtual Machines, etc. If you have multiple vcenters or ESXi hosts in your infrastructure, it is possible to combine objects from several hosts within a single tenant s scope. Next, assign a Storage Quota. The quota setting is soft, so it is possible for a tenant to temporarily exceed it. However once the quota is exceeded, subsequent backups will fail. See the Suggested Concepts chapter for some well-tested recommendations on quotas. Lastly, create one or more Tenant Users. Selected User Role will determine the level of tenant s autonomy. In order to use existing LDAP users and groups within the appliance, please refer to the LDAP Servers chapter. Edit Tenant Tenant name and description can be modified simply by clicking the Edit button in the Actions column of the overview table. To modify tenant s detailed setting, expand the tenant using the Open button. Adding or removing Managed Objects will immediately affect tenant s scope. Adding objects should have no impact on existing tenant s backup jobs. Removing objects that are part of tenant s backup job might cause the job to fail. Please note that removing Managed Objects will have no effect on existing backups. Tenant can still use these backups for file-level recovery, however any attempt to perform a full restore of VM that is no longer in tenant s scope will fail. Same principles apply to Storage Quotas. Existing backups will remain unaffected, however reducing tenant s quota below current usage level will cause any subsequent backups to fail. Delete Tenant Tenants can be removed using the Delete button in the Actions column. Deleting a tenant also deletes all backups, jobs and users created by this tenant. If you wish to keep old backups and jobs but prevent the tenant from further accessing the application, simply remove all tenant s users. 11

12 User Settings Password Change Select My Settings item in the left menu. Fill in Current password, New password and New password (verify) form items and click the Change password button. Changes are immediate, however current session will not be interrupted. Users with Admin role can also modify other users passwords by selecting System Users menu item and then clicking the Edit button at selected user. For editing tenant users passwords please see the Edit Tenant chapter. Similarly, users with Tenant Admin role have the privilege to modify other tenant users passwords by selecting Tenant Users left menu item and then editing the selected user. Reporting Users with Admin and Tenant Admin roles can optionally choose to receive backup reports in their mailbox. For reporting settings click My Settings item in your left menu. Adjust the and Send reports form elements to suit your needs and click Save. Setting the Send reports option to Immediate will make the application to send an with detailed log of every successful or failed backup attempt immediately after the operation finishes. Select Daily or Weekly options for summary reports of all backup runs in given day / week. Please note that users with Admin role receive reports about all tenant and also non-tenant backups. With large number of backup jobs this can cause a lot of chatter and changing the reporting setting to Daily or Weekly is advised. Log Out To log out from the application, click your user name in the upper right corner of the browser and select the Log Out option. Close your browser window for maximum safety. 12

13 System Settings Mailserver In some environments it can be necessary to use a central mailserver for reporting. By default, the VMcom Backup Appliance uses an internal built-in mailserver available at localhost address. To change the mailserver address select the System Settings left menu item (Admin role required). Adjust the Mailserver and Outgoing address values to fit your environment and click Save. To test your new setting, change your reporting setting to Immediately (see Reporting chapter) and run any backup job. Updating VMcom Backup Appliance It is recommended to create a snapshot of the current state of the appliance using vsphere snapshot manager. Before creating the snapshot, please make sure that all virtual disks that serve as backup storage are set to Independent Persistent mode. Select the System Settings menu item (Admin role required) and click Check for updates. The appliance will check online repositories for most recent version available. Internet access to port 443 is required for this task. If there is a new version, click Update now and watch the update process. In rare cases when update fails and the appliance is unable to recover back to previous version, use the snapshot created in step one to safely revert the operation. After the procedure is complete, remove the snapshot created in step one. Licensing A valid license code can be obtained using the VMcom shop at or from your local reseller. To get an idea about number of sockets and virtual machines in your infrastructure, please refer to application Dashboard (Admin role required). If you already have the license code, select the System Settings left menu item in your application. Paste the code into License code input element and click the Validate license button. The application will verify your new license against a VMcom licensing portal. Please note that Internet access with destination port 443 is required to complete this step. After the verification process has successfully finished, click Apply license and verify result on your Dashboard. 13

14 Configuration Backup In some cases, e.g. before deploying a new version of VMcom Backup Appliance, it may be necessary to backup the current state of the application in the form of a configuration file. The VMcom configuration file includes every setting that can be managed using the application web interface, including VMcom system settings, licensing, VMware infrastructure settings, backup storages, users and tenants, LDAP servers and backup jobs. It does not include backup files (restore points), network and timezone settings and SSL certificates. Manual Backup To manually download the configuration file, please select the System Settings left menu item and click the Export File button. Automatic Backup It is possible to save the configuration file onto a backup storage automatically after every backup task. In order to enable this feature, click the Select Storage button on the System Settings page. If you utilize a network share as a backup target, it is recommended to store the automated configuration backups to this share. For more details, please see the following chapter. Configuration Restore An existing configuration file can be used to revert the application configuration to a previous state. It is highly recommended to shut down your existing VMcom Backup Appliance and deploy a fresh one for configuration import. The appliance must not contain any active backup storages at the moment of import. Any configuration changes made before the import will be lost, except for SSL certificates and network and timezone settings. After a successful import operation, all network storage targets will be connected to the new appliance. It is vital to ensure that only one appliance has access to each storage target at a time. Please shut down or remove any old appliances before starting the import operation. Failing to do so might cause a race condition to occur. Restore From BCK File A previously downloaded configuration file can be imported using the Import File button on the System Settings page. Restore From Network Storage If you have used the Automatic Backup feature (kindly see the previous chapter) in combination with a NFS or SMB backup storage target, restore operation can be initiated simply by adding the network share containing the configuration file to a clean VMcom Backup Appliance. In order to restore, please select the Backup Storage left menu item and then click one of the Add NFS Share or Add SMB Share buttons. Enter connection details for the previously used storage. Please note that any backups kept on a local backup storage are not part of the configuration file and will be lost after the import operation. In order to import a local backup target, please contact the VMcom support. 14

15 Requesting Support Customers with a valid support contract (see your application Dashboard for current status) can request assistance via at support@vmcom.com. Please attach your license code and application version to your requests. You can obtain both on the System Settings page. In some cases, you may be asked to provide the VMcom support team with access to your appliance for the purpose of debugging. To open a remote support access, select the System Settings left menu item and click the Open button. An outgoing Internet connection with destination TCP port 22 is required for this task. About Remote Support Access Many VMcom Backup Appliance installations are hidden behind a firewall or NAT. VMcom deals with this issue by establishing an on-demand encrypted SSH connection to a secure support server. Once established, VMcom support operators can use the connection to access your application and perform required tasks. When the support access is closed, no one can access your application from the outside. 15

16 LDAP Integration Add LDAP Server LDAP integration allows the administrator to use Active Directory or OpenLDAP servers for centralized account and password management. To use an existing identity management server within VMcom Backup Appliance, select the LDAP Servers left menu item and click Add LDAP Server. Fill in the Primary LDAP host (e.g. ldap.example.com) and Base DN (e.g. dc=example,dc=com) input fields. When adding an Active Directory server, it is also necessary to enter users AD domain (e.g. example.com). Leave this field blank for other LDAPv3-compliant servers. Click Save and wait for the Status field to update. Tenant Users and Groups Select the Users & Tenants left menu item and expand any tenant by clicking the Open button. Click Add LDAP User button and select corresponding LDAP Server option. Fill in user s name and select an appropriate role. Please note that there is no need to enter Active Directory user s domain as it has been already set when adding the server. Click Save to complete the operation. The same procedure applies to handling LDAP groups. The application will try to determine LDAP user s automatically after the first successful login. Users can later change the address and reporting settings if required. System Users and Groups Select the System Users left menu item and click Add LDAP User or Add LDAP Group. Fill in the form using the instructions from the Tenant Users and Groups chapter. Please note that system users will gain access to all backups from all tenants. 16

17 Advanced Configuration Console Login Some advanced tasks require console access and basic Linux administration skills. If you require assistance at any point, please seek advice at VMcom website or contact support operators at Locate VMcom Backup Appliance virtual machine in your vsphere Client and click Open Console. If necessary, press any key to display login prompt. Use vmcom-admin as login and SEE.docs.h33 as password. Standard linux command prompt should appear upon successful login. Refer to following chapters to perform advanced tasks and troubleshooting. Documentation Conventions Lines beginning with hash sign # are comments. Words enclosed in angle brackets are meant to be replaced by appropriate values. For example, word Alabama would be used instead of <sweet_home> string. Change SSL Certificate Use of valid SSL certificates is recommended for most environments. Obtain a signed certificate for your appliance s hostname from your favorite certification authority. VMcom Backup Appliance uses standard Apache webserver for providing HTTP content. Make sure your certificate and key files are in Apache-compatible format before proceeding. Rename your certificate and key files according to the following scheme. Server certificate file to vmcom.server.crt Server key file to vmcom.server.key CA bundle file to vmcom.ca-bundle.crt Upload the resulting files into appliance s /home/vmcom-admin directory, using your favorite SCP client and credentials from the Console Login chapter. Then log in to the console and perform the following steps. # move certificate files to VMcom certificates directory sudo mv -f vmcom.server.crt vmcom.server.key vmcom.ca-bundle.crt /etc/vmba/certs/ # reload apache webserver to apply new certificates, command should return no output sudo systemctl reload httpd.service Verify the new certificate by navigating your browser to VMcom Backup Appliance hostname. 17

18 Revert SSL Certificate Changes If you are not able to access the web interface after changing SSL certificates, you can safely revert to original self-signed certificates using the following procedure. # remove faulty SSL certificates sudo rm -f /etc/vmba/certs/*.crt /etc/vmba/certs/*.key # copy original certificates from backup directory sudo cp /etc/vmba/certs/default/* /etc/vmba/certs # reload apache webserver, command should return no output on success sudo systemctl reload httpd.service Verify the result by navigating your browser to VMcom Backup Appliance hostname or IP address. Change Time Zone If you re using a vcenter Server to manage your appliance s VM, timezone setting can be changed simply by adjusting the VM s properties. Shut down the VM using the vsphere client or web client. Click Edit virtual machine settings and select Options. Timezone can be modified under vapp Options -> Properties. On a standalone ESXi host, manual intervention is required. Time zone is defined in both system settings and PHP configuration file. Perform the following steps to adjust the application s time zone. # locate your region (e.g. America or Europe) ls /usr/share/zoneinfo # locate a nearby city (e.g. New_York or London) ls /usr/share/zoneinfo/<region> # change system timezone sudo rm /etc/localtime sudo ln -s /usr/share/zoneinfo/<region>/<city> /etc/localtime # verify new setting with date command date # change timezone in /etc/php.ini sudo sed -i "s ^date.timezone =.*$ date.timezone = <region>/<city> " /etc/php.ini # reload apache webserver, command should return no output sudo systemctl reload httpd.service Change IP Address The appliance checks for IP address and other network settings after each reboot. In order to change its primary network interface settings, please shut down the appliance using vsphere client. Still in the client click Edit virtual machine settings and select Options. Network settings can be modified under vapp Options -> Properties. Power the appliance back on and verify the new setting using your web browser. 18

19 CONTACT US VMcom LLC All logos and trademarks are property of their respective owners.