Package: python-bareos
python-bareospython-bareosis a Python module to access ahttp://www.bareos.orgbackup system.Packages forpython-bareosare included in the Bareos core distribution and available viahttps://pypi.org/.Documentation is available athttps://docs.bareos.org/DeveloperGuide/PythonBareos.htmlNoteBy default, the Bareos Director (>= 18.2.4) uses TLS-PSK when communicating through the network.Unfortunately the Python core modulessldoes not support TLS-PSK.
For testingpython-bareosshould be used without TLS.
The sectionTransport Encryption (TLS-PSK)describes
how to usepython-bareoswith TLS-PSK
and about the limitations.PreparationsCreate some named consoles for testing:root@host:~#bconsole*configure add console name=user1 password=secret profile=operator TlsEnable=no
*configure add console name=user-tls password=secret profile=operatorThis creates a console user with nameuser1and the profileoperator.
Theoperatorprofile is a default profile that comes with the Bareos Director.
It does allow most commands. It only deny some dangerous commands (seeshow profile=operator),
so it is well suited for this purpose.
Futhermore, TLS enforcement is disabled for this console user.For testing with TLS-PSK, we also create the useruser-tls.ExamplesCalling bareos-director console commands>>>importbareos.bsock>>>directorconsole=bareos.bsock.DirectorConsole(address='localhost',port=9101,name='user1',password='secret')>>>print(directorconsole.call('help').decode("utf-8"))This creates a console connection to a Bareos Director.
This connection can be used tocallcommands.
These are the same commands as available viabconsole.To connect to the default console instead, omit thenameparameter:>>>directorconsole=bareos.bsock.DirectorConsole(address='localhost',port=9101,password='defaultconsolepassword')The result of the call method is abytesobject. In most cases, it has to be decoded to UTF-8.Simple version of the bconsole in Python>>>importbareos.bsock>>>directorconsole=bareos.bsock.DirectorConsole(address='localhost',port=9101,password='secret')>>>directorconsole.interactive()Or use the includedbconsole.pyscript:bconsole.py --debug --name=user1 --password=secret localhostUse JSON objects of the API mode 2Requires: Bareos >= 15.2The classDirectorConsoleJsonis inherited fromDirectorConsoleand uses the Director Console API mode 2 (JSON).For general information about API mode 2 and what data structures to expect,
seehttps://docs.bareos.org/DeveloperGuide/api.html#api-mode-2-jsonExample:>>>importbareos.bsock>>>directorconsole=bareos.bsock.DirectorConsoleJson(address='localhost',port=9101,password='secret')>>>pools=directorconsole.call('list pools')>>>forpoolinpools["pools"]:...print(pool["name"])...ScratchIncrementalFullDifferentialThe results the thecallmethod is adictobject.In case of an error, an exception, derived frombareos.exceptions.Erroris raised.Example:>>>directorconsole.call("test it")Traceback(mostrecentcalllast):...bareos.exceptions.JsonRpcErrorReceivedException:failed:testit:isaninvalidcommand.Transport Encryption (TLS-PSK)Since Bareos >= 18.2.4, Bareos supports TLS-PSK (Transport-Layer-Security Pre-Shared-Key) to secure its network connections and uses this by default.Unfortenatly, the Python core modulessldoes not support TLS-PSK.
There is limited support by the extra modulesslpsk(seehttps://github.com/drbild/sslpsk).Fallback To Unencrypted ConnectionsIn order to work in most cases, even ifsslpskis not available,
theDirectorConsoleuses a fallback.
If connecting via TLS-PSK fails, it falls back to the old, unencrypted protocol version.
In this case, a warning is issued, but the connection will work nevertheless:>>>importbareos.bsock/.../bareos/bsock/lowlevel.py:39:UserWarning:ConnectionencryptionviaTLS-PSKisnotavailable,asthemodulesslpskisnotinstalled.>>>directorconsole=bareos.bsock.DirectorConsole(address='localhost',port=9101,name='user-tls',password='secret')socketerror:Conversationterminated(-4)Failedtoconnectusingprotocolversion2.Tryingprotocolversion1.>>>print(directorconsole.call('help').decode("utf-8"))To enforce a encrypted connection, use thetls_psk_require=Trueparameter:>>>importbareos.bsock/.../bareos/bsock/lowlevel.py:39:UserWarning:ConnectionencryptionviaTLS-PSKisnotavailable,asthemodulesslpskisnotinstalled.>>>directorconsole=bareos.bsock.DirectorConsole(address='localhost',port=9101,name='user-tls',password='secret',tls_psk_require=True)Traceback(mostrecentcalllast):[...]bareos.exceptions.ConnectionError:TLS-PSKisrequired,butsslpskmodulenotloaded/available.In this case, an exception is raised, if the connection can not be established via TLS-PSK.sslpskThe extra modulesslpsk(seehttps://github.com/drbild/sslpsk)
extends the core modulesslby TLS-PSK.At the time of writing, the lasted version installable via pip is 1.0.0 (https://pypi.org/project/sslpsk/), which is not working with Python >= 3.Ifpython-bareosshould use TLS-PSK with Python >= 3,
the latest version must by installed manually:gitclonehttps://github.com/drbild/sslpsk.gitcdsslpskpythonsetup.pybuildpythonsetup.pyinstallpython-bareoswill detect, thatsslpskis available and will use it automatically.
This can be verified by following command:>>>importbareos.bsock>>>bareos.bsock.DirectorConsole.is_tls_psk_available()TrueAnother limitation of the currentsslpskversion is,
that it is not able to autodetect the TLS protocol version to use.In order to use it, specifytls_versionwith an appropriate protocol version.
In most cases this should betls_version=ssl.PROTOCOL_TLSv1_2,
like in the following example:>>>importssl>>>importbareos.bsock>>>directorconsole=bareos.bsock.DirectorConsoleJson(address='localhost',user='user-tls',password='secret',tls_version=ssl.PROTOCOL_TLSv1_2)>>>print(directorconsole.call('help').decode("utf-8"))