Installing Bareos Webui

This chapter addresses the installation process of the Bareos WebUI.

Since Version >= 15.2.0 Bareos WebUI is part of the Bareos project and available for a number of platforms.

Features

Intuitive web interface
Multilingual
Can access multiple directors and catalogs
Individual accounts and ACL support via Bareos restricted named consoles
Tape Autochanger management with the possibility to label, import/export media and update your autochanger slot status
Temporarly enable or disable jobs, clients and schedules and also see their current state
Show
- Detailed information about Jobs, Clients, Filesets, Pools, Volumes, Storages, Schedules, Logs and Director messages
- Filedaemon, Storage- and Director updates
- Client, Director, Storage and Scheduler status
Backup Jobs
- Start, cancel, rerun and restore from
- Show the file list of backup jobs
Restore files by browsing through a filetree of your backup jobs
- Merge your backup jobs history and filesets of a client or use a single backup job for restore
- Restore files to a different client instead of the origin
bconsole interface (limited to non-interactive commands)

System Requirements

A platform for which the bareos-webui package is available, see Bareos Packages
A working Bareos environment
Bareos Director version and Bareos WebUI version must match
The Bareos WebUI can be installed on any host. It does not have to be installed on the same as the Bareos Director.
The default installation uses PHP-FPM with Apache HTTP webserver having mod-rewrite and mod-fcgid enabled.
PHP 7 or newer is recommended.
On SUSE Linux Enterprise 12 you need the additional SUSE Linux Enterprise Module for Web Scripting 12.

Installation

Adding the Bareos Repository

If not already done, add the Bareos repository that is matching your Linux distribution. Please have a look at the chapter Install the Bareos Software Packages for more information on how to achieve this.

Install the bareos-webui package

After adding the repository simply install the bareos-webui package via your package manager.

RHEL, CentOS and Fedora

yum install bareos-webui

or

dnf install bareos-webui

SUSE Linux Enterprise Server (SLES), openSUSE
```
zypper install bareos-webui
```
Debian, Ubuntu
```
apt-get install bareos-webui
```

Minimal Configuration

This assumes, Bareos Director and Bareos WebUI are installed on the same host.

If you are using SELinux, allow HTTPD scripts and modules make network connections:
```
setsebool -P httpd_can_network_connect on
```
For details, see SELinux.
Restart Apache (to load configuration provided by bareos-webui, see Configure your Apache Webserver)
Use bconsole to create a user with name admin and password secret and permissions defined in webui-admin (Dir->Profile):
```
*reload
reloaded
*configure add console name=admin password=secret profile=webui-admin tlsenable=false
```
Of course, you can choose other names and passwords. For details, see Create a restricted consoles.
Login to http://HOSTNAME/bareos-webui with username and password as created.

Configuration Details

Create a restricted consoles

There is not need, that Bareos WebUI itself provide a user management. Instead it uses so named Console (Dir) defined in the Bareos Director. You can have multiple consoles with different names and passwords, sort of like multiple users, each with different privileges.

At least one Console (Dir) is required to use the Bareos WebUI.

To allow a user with name admin and password secret to access the Bareos Director with permissions defined in the webui-admin (Dir->Profile) (see Configuration of profile resources), either

create a file /etc/bareos/bareos-dir.d/console/admin.conf with following content:
bareos-dir.d/console/admin.conf
```
Console {
  Name = "admin"
  Password = "secret"
  Profile = "webui-admin"
  TlsEnable = false
}
```
To enable this, reload or restart your Bareos Director.
or use the bconsole:
```
*configure add console name=admin password=secret profile=webui-admin tlsenable=false
```
If the profile could not be found, reload or restart your Bareos Director.

TLS-PSK is not available between the Bareos WebUI and the Bareos Director. To enable TLS with certificates, see Bareos Webui.

For details, please read Console Resource.

Configuration of profile resources

The package bareos-webui comes with a predefined profile for Bareos WebUI: webui-admin (Dir->Profile).

If your Bareos WebUI is installed on another system than the Bareos Director, you have to copy the profile to the Bareos Director.

This is the default profile, giving access to all Bareos resources and allowing all commands used by the Bareos WebUI:

bareos-dir.d/profile/webui-admin.conf

Profile {
  Name = webui-admin
  CommandACL = !.bvfs_clear_cache, !.exit, !.sql, !configure, !create, !delete, !purge, !sqlquery, !umount, !unmount, *all*
  Job ACL = *all*
  Schedule ACL = *all*
  Catalog ACL = *all*
  Pool ACL = *all*
  Storage ACL = *all*
  Client ACL = *all*
  FileSet ACL = *all*
  Where ACL = *all*
  Plugin Options ACL = *all*
}

The Profile (Dir) itself does not give any access to the Bareos Director, but can be used by Console (Dir), which do give access to the Bareos Director, see Create a restricted consoles.

For details, please read Access Control Configuration and Profile Resource.

SELinux

To use Bareos Director on a system with SELinux enabled, permission must be given to HTTPD to make network connections:

setsebool -P httpd_can_network_connect on

Configure your Apache Webserver

The package bareos-webui provides a default configuration for Apache. Depending on your distribution, it is installed at /etc/apache2/conf.d/bareos-webui.conf, /etc/httpd/conf.d/bareos-webui.conf, /etc/apache2/available-conf/bareos-webui.conf or similar.

The required Apache modules, fcgid and rewrite are enabled via package postinstall script. However, after installing the bareos-webui package, you need to restart your Apache webserver manually.

Configure your /etc/bareos-webui/directors.ini

Configure your directors in /etc/bareos-webui/directors.ini to match your settings.

The configuration file /etc/bareos-webui/directors.ini should look similar to this:

/etc/bareos-webui/directors.ini

;
; Bareos WebUI Configuration File
;
; File: /etc/bareos-webui/directors.ini
;

;------------------------------------------------------------------------------
; Section localhost-dir
;------------------------------------------------------------------------------
[localhost-dir]

; Enable or disable section. Possible values are "yes" or "no", the default is "yes".
enabled = "yes"

; Fill in the IP-Address or FQDN of you director.
; E.g. alice.example.com, 127.0.0.1 or [::1]
diraddress = "localhost"

; Default value is 9101
dirport = 9101

; Set catalog to explicit value if you have multiple catalogs
;catalog = "MyCatalog"

; TLS verify peer
; Possible values: true or false
tls_verify_peer = false

; Server can do TLS
; Possible values: true or false
server_can_do_tls = false

; Server requires TLS
; Possible values: true or false
server_requires_tls = false

; Client can do TLS
; Possible values: true or false
client_can_do_tls = false

; Client requires TLS
; Possible value: true or false
client_requires_tls = false

; Path to the certificate authority file
; E.g. ca_file = "/etc/bareos-webui/tls/BareosCA.crt"
;ca_file = ""

; Path to the cert file which needs to contain the client certificate and the key in PEM encoding
; E.g. ca_file = "/etc/bareos-webui/tls/restricted-named-console.pem"
;cert_file = ""

; Passphrase needed to unlock the above cert file if set
;cert_file_passphrase = ""

; Allowed common names
; E.g. allowed_cns = "host1.example.com"
;allowed_cns = ""

;------------------------------------------------------------------------------
; Section another-host-dir
;------------------------------------------------------------------------------
[another-host-dir]
enabled = "no"
diraddress = "192.168.120.1"
dirport = 9101
;catalog = "MyCatalog"
;tls_verify_peer = false
;server_can_do_tls = false
;server_requires_tls = false
;client_can_do_tls = false
;client_requires_tls = false
;ca_file = ""
;cert_file = ""
;cert_file_passphrase = ""
;allowed_cns = ""

You can add as many directors as you want, also the same host with a different name and different catalog, if you have multiple catalogs.

Configure your /etc/bareos-webui/configuration.ini

Since Version >= 16.2.2 you are able to configure some parameters of the Bareos WebUI to your needs.

/etc/bareos-webui/configuration.ini

;
; Bareos WebUI Configuration File
;
; File: /etc/bareos-webui/configuration.ini
;

;------------------------------------------------------------------------------
; SESSION SETTINGS
;------------------------------------------------------------------------------
;
;[session]
; Session timeout in seconds
; Default:
;timeout=3600

;------------------------------------------------------------------------------
; DASHBOARD SETTINGS
;------------------------------------------------------------------------------
;[dashboard]
; Autorefresh Interval in milliseconds
; Default:
;autorefresh_interval=60000

;------------------------------------------------------------------------------
; TABLE SETTINGS
;------------------------------------------------------------------------------
;[tables]
; Possible values for pagination
; Default:
;pagination_values=10,25,50,100

; Default number of rows per page
; for possible values see pagination_values
; Default:
;pagination_default_value=25

; State saving - restore table state on page reload.
; Default:
;save_previous_state=false

;------------------------------------------------------------------------------
; VARIOUS SETTINGS
;------------------------------------------------------------------------------
;[autochanger]
; Name of the pool used to label and assign new media, e.g. Scratch.
; Default:
;labelpooltype=

;[restore]
; Restore filetree refresh timeout in milliseconds
; Default:
;filetree_refresh_timeout=120000

;------------------------------------------------------------------------------
; THEME SETTINGS
;------------------------------------------------------------------------------
;[theme]
; Possible values: default, sunflower
; Default:
;name=sunflower

Configure updating the Bvfs cache frequently

The restore module in the Bareos WebUI makes use of the Bvfs API and for example the .bvfs_update command to generate or update the Bvfs cache for jobs that are not already in the cache.

In case of larger backup jobs with lots of files that are not already in the cache, this could lead to timeouts while trying to load the filetree in the Bareos WebUI. That is why we highly recommend to update the Bvfs cache frequently.

This can be accomplished by the Run Script directive of a Job Resource.

The following code snippet is an example how to run the cache update process in a RunScript after the catalog backup.

Job {
  Name = "BackupCatalog"
  Level = Full
  Fileset = "Catalog"
  Schedule = "WeeklyCycleAfterBackup"
  JobDefs = "DefaultJob"
  WriteBootstrap = "|/usr/sbin/bsmtp -h localhost -f "(Bareos) " -s "Bootstrap for Job %j" root@localhost"
  Priority = 100
  run before job = "/usr/lib/bareos/scripts/make_catalog_backup MyCatalog"
  run after job = "/usr/lib/bareos/scripts/delete_catalog_backup MyCatalog"
  Run Script {
    Console = ".bvfs_update"
    RunsWhen = After
    RunsOnClient = No
  }

Note

We do not provide a list of Jobs specified in the JobId command argument so the cache is computed for all jobs not already in the cache.

As an alternative to the method above the Bvfs cache can be updated after each job run by using the Run Script directive as well.

Job {
  Name = "backup-client-01"
  Client = "client-01.example.com"
  JobDefs = "DefaultJob"
  Run Script {
    Console = ".bvfs_update jobid=%i"
    RunsWhen = After
    RunsOnClient = No
  }
}

Note

We do provide a specific JobId in the JobId command argument in this example. Only the JobId given by the placeholder %i will be computed into the cache.

Upgrade from Bareos 21 or lower to Bareos 22

Bareos WebUI now requires php-fpm instead of Apache mod-php.

Usually this should be automatically handled by the packagemanager while updating.

Please consider the following remarks below according to your operating system of choice if auto upgrading does not work for you.

If the Bareos WebUI is not reachable after upgrading, make sure that:

Apache mod-php is disabled or has been removed
php-fpm* usage is configured properly in Apache
php-fpm service is enabled and has been restarted
Apache service has been restarted

Debian, Ubuntu, Univention

Please use apt instead of apt-get to upgrade automatically.

SUSE Linux Enterprise Server (SLES), openSUSE

Before upgrading

Disable or remove any PHP module in Apache2

After upgrading

Ensure a php.ini file is in place (e.g. /etc/php7/fpm/php.ini or /etc/php8/fpm/php.ini)
Configure PHP-FPM to your needs (e.g. /etc/php7/fpm/php-fpm.conf and /etc/php7/fpm/php-fpm.d/www.conf)
Configure mod_fcgid to your needs /etc/apache2/conf.d/mod_fcgid.conf

A minimal example may look like following.

/etc/apache2/conf.d/mod_fcgid.conf

<IfModule fcgid_module>
     DirectoryIndex index.php
     <FilesMatch "\.php$">
             SetHandler "proxy:fcgi://127.0.0.1:9000/"
             #CGIPassAuth on
     </FilesMatch>
</IfModule>

Restart Apache2 and PHP-FPM

systemctl restart apache2 php-fpm

Console/Profile changes

The Bareos WebUI restore form now accepts a plugin options string in the restore form for plugin restores. Therefore, the Bareos WebUI Director profile webui-admin (Dir->Profile) has been extended by the directive Plugin Options ACL (Dir->Profile) = *all* in Bareos Version >= 22.0.0. To make use of that feature in Bareos WebUI, a proper configured Plugin Options ACL (Dir->Profile) is required.

Upgrade from 18.2.6 to 18.2.7

Configuration changes

The configuration file configuration.ini of the Bareos WebUI shipped with Bareos 18.2.7 introduced a new configuration parameter called filetree_refresh_timeout. The default value is 120 seconds if not set explicitly.

The Bareos WebUI triggers a Bvfs cache update automatically if required to be able to display the requested filetree. The configuration parameter has been introduced because in case of larger backup jobs with lots of files which are not already present in the Bvfs cache you could run into timeouts while trying to load the filetree in the restore module of the Bareos WebUI.

If you have trouble with running into timeouts while loading the tree you can adjust the parameter filetree_refresh_timeout to your needs. Keep in mind to set the timeout in your Apache or Nginx configuration accordingly to the setting in your configuration.ini.

In general we highly recommend updating the Bvfs cache frequently. Please see Configure updating the Bvfs cache frequently for further details on how to accomplish this.

Upgrade from 15.2 to 16.2

Console/Profile changes

The Bareos WebUI Director profile shipped with Bareos 15.2 (webui (Dir->Profile) in the file /etc/bareos/bareos-dir.d/webui-profiles.conf) is not sufficient to use the Bareos WebUI 16.2. This has several reasons:

The handling of Acl`s is more strict in Bareos 16.2 than it has been in Bareos 15.2. Substring matching is no longer enabled, therefore you need to change :bcommand:.bvfs_*` to .bvfs_.* in your Command ACL (Dir->Profile) to have a proper regular expression. Otherwise the restore module won’t work any longer, especially the file browser.
The Bareos WebUI 16.2 uses following additional commands:
- .help
- .schedule
- .pools
- import
- export
- update
- release
- enable
- disable

If you used an unmodified /etc/bareos/bareos-dir.d/webui-profiles.conf file, the easiest way is to overwrite it with the new profile file /etc/bareos/bareos-dir.d/profile/webui-admin.conf. The new webui-admin (Dir->Profile) allows all commands, except of the dangerous ones, see Configuration of profile resources.

directors.ini

Since Version >= 16.2.0 it is possible to work with different catalogs. Therefore the catalog parameter has been introduced. If you don’t set a catalog explicitly the default MyCatalog (Dir->Catalog) will be used. Please see Configure your /etc/bareos-webui/directors.ini for more details.

configuration.ini

Since 16.2 the Bareos WebUI introduced an additional configuration file besides the directors.ini file named configuration.ini where you are able to adjust some parameters of the webui to your needs. Please see Configure your /etc/bareos-webui/directors.ini for more details.

Additional information

NGINX

If you prefer to use Bareos WebUI on Nginx with php5-fpm instead of Apache, a basic working configuration could look like this:

bareos-webui on nginx

server {

        listen       9100;
        server_name  bareos;
        root         /var/www/bareos-webui/public;

        location / {
                index index.php;
                try_files $uri $uri/ /index.php?$query_string;
        }

        location ~ .php$ {

                include snippets/fastcgi-php.conf;

                # php5-cgi alone:
                # pass the PHP
                # scripts to FastCGI server
                # listening on 127.0.0.1:9000
                #fastcgi_pass 127.0.0.1:9000;

                # php5-fpm:
                fastcgi_pass unix:/var/run/php5-fpm.sock;

                # APPLICATION_ENV:  set to 'development' or 'production'
                #fastcgi_param APPLICATION_ENV development;
                fastcgi_param APPLICATION_ENV production;

        }

}

This will make the Bareos WebUI accessible at http://bareos:9100/ (assuming your DNS resolve the hostname bareos to the NGINX server).

php.ini settings

The Bareos WebUI relies on date functions. Set the date.timezone directive according to the timezone of your Bareos Director.

[Date]
; Defines the default timezone used by the date functions
; http://php.net/date.timezone
date.timezone = Europe/Berlin