This script can backup the configs from firewalls and switches.

Check the file REQUIREMENTS to see all packet dependencies.

Step 1. git clone https://github.com/MrMarioMichel/Config-Backupper --> this branch should work otherwise download one of the newest release

Step 2. cd ./Config-Backupper --> enter the downloaded repository

Step 3. chmod 700 ./setup.sh --> make the setup.sh executable

Step 4. ./setup.sh --> start the setup.sh

Here you can define (in days) when the archived configs get compressed*. (Recommended : 14)

Here you can define (in days) when the archived configs get deleted*. (Recommended : 90)

Here you can define (in days) when the archived logs get compressed*. (Recommended : 14)

Here you can define (in days) when the archived logs get deleted*. (Recommended : 90)

*If you don't want to deleted/commpress the configs/logs is set it to 9999. --> No compression/deletion for 27 Years long enough...

Here you can define the SSH Key used to authenticate at the devices. (Recommended : 4096 or higher)

Use low bit key length (1024 - 2048bits) to speed up the authentication BUT SECURITY SUFFERS FROM IT !!!.

Just press enter otherwise the script would need everytime it connects to a devices the password. Still want to have a password you will neeed to enter the password in clear text in the ./Modules/Backup/<VENDOR>/<MODUDLE>.sh module sshpass -p "<PASSWORD>" scp -i ./SSH-Keys/Backup-SSH-Key backup@<IP>:<CONFIGFILE> ./TestConfigFile

Again just enter.

Launch ./Modules/Setup/WebsiteIndex.sh to hook up the Archive folder to the webserver directory.

Create a crontab with ...

0 9 1 * * echo "Generated by FirmwareChecker.sh" | mailx -s "Firmware Versions $(date "%d-%m-%Y")" -r <SENDER-EMAIL-ADDRESS> -S smtp="<MAIL-SERVER-IP-OR-DOMAIN>:25" -a /<ABSOLUTE-PATH>/Config-Backupper/Devices/Firmware-Versions/Fortinet-Firmware-Versions.txt -a /<ABSOLUTE-PATH>/Config-Backupper/Devices/Firmware-Versions/Fortinet-Firmware-Count.txt <REZIPIENT-EMAIL-ADDRESS>

e.g.

0 9 1 * * echo "Generated by FirmwareChecker.sh" | mailx -s "Firmware Versions $(date "%d-%m-%Y")" -r [email protected] -S smtp="mail.mariomichel.com:25" -a /home/mario/Config-Backupper/Devices/Firmware-Versions/Fortinet-Firmware-Versions.txt -a /home/mario/Config-Backupper/Devices/Firmware-Versions/Fortinet-Firmware-Count.txt [email protected]

and get every month at 9:00am a mail* with two attatments with statistics of Fortinet Firmware installed on the FortiGates. See below...

*You can also display them on a website see for this Hook stats to a website

In ./Modules/FirmwareCheck/Fortinet/FirmwareChecker.sh under the section Display on a website you can enable a command that will create you html files by uncommenting the line (removing the #). All infos in the module.

In ./Devices/<VENDOR>/<DEVICE-MODEL>.txt you need to enter line by line all IP addresses.

<IP> --> <HOSTNAME> ### <COMMENT>

192.168.1.1 --> mm-vie-fw-01 ### Firewall is very secure*

Use a # in front of a line to uncomment a line (This will get ignored from the backup script).

#10.0.0.1 --> mm-vie-fw-01-old ### Old Firewall*

*Hostname (will be obtained from the backup file directly) and a comment are optional.

In ./Main-Launcher.sh are modules under the section Backup Modules that need to enabled by uncommenting the line (removing the #). Check with ./Modules/Setup/ModuleChecker.sh if all needed modules has been enabled correctly.

...
### Backup Modules ###
./Modules/Backup/Fortinet/Fortinet.sh &>> ./Log/Fortinet/log$date.txt             <-- Module enabled
./Modules/Backup/Cisco/Cisco.sh &>> ./Log/Cisco/log$date.txt                      <-- Module enabled
# ./Modules/Backup/DELL/DELL.sh &>> ./Log/DELL/log$date.txt                       <-- Module disabled
# ./Modules/Backup/HP/HP.sh &>> ./Log/HP/log$date.txt                             <-- Module disabled
...

./Modules/Backup/<VENDOR>/<DEVICE-MODEL>.sh are sub modules and under the section Sub Backup Modules you need to enable the sub backup moudles by uncommenting the line (removing the #). Check with ./Modules/Setup/ModuleChecker.sh if all needed modules has been enabled correctly.

...
### Backup Modules ###
./Modules/Backup/Cisco/sgX00.sh            <-- Module enabled
# ./Modules/Backup/Cisco/n3XXX.sh          <-- Module disabled
...

In each* submodule you will find a section on the top that looks like that. in this section you need to define the credencals

...
user="<VENDOR>"
passwd="XXXXXXPASSWORDXXXXXX"
...

*Fortigates are working with the SSH key. No password required.

Create or use an existing read only profile for a user named "backup" (All in small letters, all togther, no spaces) on the device. This user should get only read rights for highest security. Also add the ./SSH-Keys/Backup-SSH-Key.pub to the user that this key pair can be used to login. See table Use SSH-Key for Authenictaion how to do that for each vendor.

Note : Run as sudo !!!

You can test the script (Recommended) befor you run it automaticaly to get the config file with scp -P <PORT> -vvv -i ./SSH-Keys/Backup-SSH-Key backup@<IP>:<CONFIGFILE> ./TestConfigFile. If that worked and the config file is now stored as TestConfigFile. You can delete the TestConfgiFile and run the script and see what happens.

The script uses a (YOU-CHOOSE-IT) bit long SSH Key for authentication. That key must be added to all devices at the user backup in order for the script to get the configs. In the directory ./Log will be all output generated by the script for each day and each vendor.