Package: rdiffweb
website•docs•community•demoWelcome to RdiffwebRdiffweb is a web application that allows you to view repositories generated
byrdiff-backup. The purpose of this
application is to ease the management of backups and quickly restore your data
with a rich and powerful web interface.Rdiffweb is written in Python and is released as open source project under the
GNU GENERAL PUBLIC LICENSE (GPL). All source code and documentation are
Copyright Rdiffweb contributors.Rdiffweb is actively developed byIKUS Softsince November 2014.The Rdiffweb source code is hosted onGitlaband mirrored toGithub.The Rdiffweb website ishttps://rdiffweb.org/.FeaturesWith its rich web interface Rdiffweb provide a notable list of features:Browse your backupRestore single file or multiple files as an archivedUsers authentication via local database and LDAPUsers authorizationEmail notification when backup is not successfulConfigurable repository encodingConfigurable retention periodBackup statistics visualization using graphsSSH Keys managementDisk quota visualizationFile and folder deletionDemoIf you quickly want to check how Rdiffweb is behaving, you may try our demo server hosted on:https://rdiffweb-demo.ikus-soft.com/Use the following credential to login:Username: adminPassword: admin123Installation & Docker usageFor detailed installation steps, read theInstallation documentation.Current Build StatusDownloadYou should read theDocumentationto properly install Rdiffweb in your environment.Dockerdocker pull ikus060/rdiffwebDebianapt install lsb-release
curl -L https://www.ikus-soft.com/archive/rdiffweb/public.key | gpg --dearmor > /usr/share/keyrings/rdiffweb-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/rdiffweb-keyring.gpg] https://nexus.ikus-soft.com/repository/apt-release-$(lsb_release -sc)/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/rdiffweb.list
apt update
apt install rdiffwebPypipip install rdiffwebNewsletterSubscribing to our newsletter is an effective way to stay up-to-date on the latest news about Rdiffweb.
By signing up for, you will receive regular updates and notifications about new features, updates, and releases related to Rdiffweb.Rdiffweb Newsletter.Google GroupJoin our growing community to get answers to your technical questions.Rdiffweb users should use theRdiffweb Google Group.DocumentationWant to know more about Rdiffweb and learn it thoroughly? Read our complete documentation.Rdiffweb Documentation.Bug ReportsBug reports should be reported on the Rdiffweb Gitlab athttps://gitlab.com/ikus-soft/rdiffweb/-/issuesProfessional supportProfessional support for Rdiffweb is available bycontacting IKUS Soft.Support Us Through Github SponsorshipWe are passionate about developing and maintaining this open-source project to make it better with each update. Your support can help us continue our efforts and enhance the project for the entire community. By becoming a Github Sponsor, you directly contribute to the project's sustainability and growth.Becoming a SponsorChangelog2.8.8 (2023-01-08)Fix usage ofsession-idle-timeoutin config file #2962.8.7 (2024-01-04)Adjust the session idle and absolute timeouts to 10 and 30 minutes, respectively.Fix date calculation when generating report in January #2952.8.6 (2023-11-24)Fix broken URL tohttps://ikus-soft.comFix "Remember me" check box to allow cliking on label to ease usability #293Fix translation of backup status in email report #291Adding German translation file - credit toMichael Nitzsche2.8.5 (2023-10-10)Fix reported version in Debian package #289Add support for WTForms v3.1.0Add last backup date to email notiication2.8.4 (2023-09-29)Add ratelimit to Access Token, SSH Keys and User creationCVE-2023-52892.8.3 (2023-08-22)Drop support of Ubuntu Kinetic2.8.2 (2023-08-22)Add Ubuntu Mantic SupportUse Multi-Step to build Docker imageUpdate layout of file statistics to display a single dayStop sending notification for ignored days #284Handle warning exit code 2 return by rdiff-backup version 2.22.8.1 (2023-08-01)Pin version of selenium to v4.102.8.0 (2023-07-31)Log detailed error message when restore command failed to help debuggingUpdate interface used to manage users to be more user friendly #237Disable Disk Quota in users view when quota command is not configured #237Hide LDAP label in users view when LDAP is not configured #237Allow administrator to change user's reporting preferencesAdd support for Ubuntu LunarAdd support for SQLAlchemy v2.0 for forward compatibilityWhen reaching 100% disk usage, show quota in red to improve visibilitySend notification when user's quota reach 90% #46Add ratelimit to "send me a status report" to avoid email flooding #272 - credit toNehal PillaiFix creation of access token with expiration time #277Allow user to disable notification for selected day of week #278Add detailed file statistics to show created, modified and deleted files #103Trim spaces on verification code to improve usability #279Determine default username when user get redirected to login page #283Sort repository by dates in administration view #282Document how to configure fail2ban to improve server hardeningDocument how to configure certbot for automatic SSL certificate generationUpdate installation steps to includearch=amd64Update french translation2.7.1 (2023-04-27)Fix encoding problem with older Outlook 2007 client #2732.7.0 (2023-04-20)Support Python 3.11Provide a Monthly, Weekly or Daily repport for user #71Fix MFA verification code email's subjet #270Add translation for footer not in email layoutSend email to administrator when a new version is available #266Improve automatic testing2.6.1 (2023-03-22)Refused to start ifrdiff-backupexecutable is not found #2672.6.0 (2023-03-15)Review the application layout to use Fluid container to use all the space available on the screenRename status view to DashboardDisplay more useful data in Dashboard view: Backups per days, Oldest backup, Storage Usage, Average duration, Least Active, Most activeFix deletion confirmation of repositories within subdirectory #250Properly clean-up plain text email from HTML tagsSend notification for inactive backup based on statisticsSend notification using a new template following the web interface brandingSend notification to user when repository get added or removedSend all notification to an optional "catch-all" email address configured using--email-catch-alloption #258Redistribute logos in PNG format for better compatibilityDisable error page logs for 4xx errorsAdd username and IP address to logs only for HTTP RequestFix LDAP integration to support non-list attributes - credit toShane RobinsonAdd support of multiple required-group for LDAP integrationImprove System Logs view to identify "User Activity", "Threats" and "User Login"Fix display of "* minutes ago" #264Adddefault-langoption to configure default language #263Allow user to select a preferred language #263Use user's preferred language when sending notifications #2632.5.8 (2023-02-19)Support Setuptools v66 for compatibility with Debian BookwormFix execution of rdiffweb remove-older job to clean-up repository history #2622.5.7 (2023-01-27)Enforce SQLAlchemy version between 1.2 or 1.42.5.6 (2023-01-11)Fixed display of Hamburger menu on mobiles (minarca#192)Change wording for interupted backup2.5.5 (2022-12-23)Fix loading of Charts in Status pageEnsure Gmail and other mail client doesn't create hyperlink automatically for any nodification sent by Rdiffweb to avoid phishing - credit toNehal PillaiSent email notification to user when a new SSH Key get added - credit toNehal PillaiRatelimit "Resend code to my email" in Two-Factor Authentication view - credit toNehal PillaiUsername are not case-insensitive - credits toraiders0786Make sure that all ssh keys are unique, regardless of the user - credit toNehal PillaiDisable translation cachingBreaking changes:Username with different cases (e.g.: admin vs Ammin) are not supported. If your database contains such username make sure to remove them before upgrading otherwise Rdiffweb will not start.2.5.4 (2022-12-19)DiscardX-Forwarded-Hostheaders credit toAnishka ShuklaCreate proper symbolic link ofchartkick.json Ubuntu Jammy to fix loading of Charts in web interfaceAdd CSRF verification on/logoutcredits toreza.duty2.5.3 (2022-12-05)Add support for WTForms v3 to support Debian BookwormFix strange behavior in access token management #2472.5.2 (2022-11-28)Block repository access when user_root directory is empty or relative pathCVE-2022-4314credit toneverjuniorReplace admin password only when--admin-passwordoption is provided #246Invalidate browser cache forlogo,headerlogoandfaviconon restart #2452.5.1 (2022-11-11)Add support for Ubuntu Kinetic #240Disable filesize for deleted files to improve page loading #2412.5.0 (2022-11-09)This next release focus on two-factor-authentication as a measure to increase security of user's account.Store User's session information into databaseUpdate ldap plugin to load additional attributes from LDAP serverImprove/statuspage error handling whensession_statisticscannot be readAdd support for Ubuntu JammyUpgrade from Bootstrap v3 to v4 #204Replace Fontello by Font-Awesome v4Use CSS variablesvar()to customize themes using--branding-Xoptions #239Remove usage of Jquery.validateReplace custom timsort by jquery DataTables #205Add Active Session managements #203Active session should be visible in user's profilesActive session may be revoked by userActive session should be visible in administration viewAction session may be revoke by administratorShow number of active users within the last 24 hours in dashboardHandle migration of older Rdiffweb database by adding the missingrepos.Encoding,repos.keepdaysandusers.rolecolumns #185Replace deprecated references ofdisutils.spawn.find_executable()byshutil.which()#208Add two-factor authentication with email verification #201Generate a new session on login and 2FA #220Enforce permission on /etc/rdiffweb configuration folderEnforce validation on fullname, username and emailLimit incorrect attempts to change the user's password to prevent brute force attacks #225CVE-2022-3273credit toNehal PillaiEnforce password policy new password cannot be set as new passwordCVE-2022-3376credit toNehal PillaiEnforce better rate limit on login, mfa, password change and APICVE-2022-3439CVE-2022-3456credit toNehal PillaiEnforce 'Origin' validationCVE-2022-3457credit toNithissh12Define idle and absolute session timeout with agressive default to protect usage on public computerCVE-2022-3327credit toNehal PillaiSend email notification when enabling or disabling MFACVE-2022-3363credit toNehal PillaiUse Argon2id to store password hash #231Fixed plugin priorities to ensure that jobs are scheduled at each startup #232Revoke previous user's sessions on password changeCVE-2022-3362credit toNehal PillaiBreaking changes:Drop Ubuntu Hirsute & Impish (End-of-life)session-diris deprecated and should be replace byrate-limit-dir. User's session are stored in database.previous.csscustomization are not barkward compatible. Make usage of the--branding-Xoptions.Thanks toNehal Pillaiwith whom I collaborate to improve the security of this project.2.4.10 (2022-10-03)This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.Mitigate path traversal vulnerabilityCVE-2022-3389credit toHoang Van Hiep2.4.9 (2022-09-28)This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.AddCache-Controland other security headersCVE-2022-3292credit toNehal PillaiEnforce password policy usingpassword-scorebased onzxcvbnCVE-2022-3326credit toNehal Pillai2.4.8 (2022-09-26)This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.Clean-up invalid path on error pageLimit username field lengthCVE-2022-3290credit toNehal PillaiLimit user's email field lengthCVE-2022-3272credit toNehal PillaiLimit user's root directory field lengthCVE-2022-3295credit toNehal PillaiLimit SSH Key title field lengthCVE-2022-3298credit toNehal Pillai2.4.7 (2002-09-21)This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.Generate a new session on login and 2FA #220CVE-2022-3269credit toAmbadi MPMitigate CSRF on user's settings #221CVE-2022-3274credit toirfansayyed2.4.6 (2022-09-20)This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.Support MarkupSafe<3 for Debian bookwormMitigate CSRF on user's notification settings #216CVE-2022-3233credit toAmbadi MPMitigate CSRF on repository settings #217CVE-2022-3267credit toirfansayyedUse 'Secure' Attribute with Sensitive Cookie in HTTPS Session on HTTP Error #218CVE-2022-3174credit toChuu2.4.5 (2002-09-16)This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.Mitigate CSRF on repository deletion and user deletionCVE-2022-3232#214 #215 credit toAmbadi MP2.4.4 (2002-09-15)This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.UseX-Real-IPto identify client IP address to mitigate Brute-Force attack #2132.4.3 (2022-09-14)This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.Mitigate CSRF in profile's SSH KeysCVE-2022-3221#212 credit toAmbadi MP2.4.2 (2022-09-12)This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.Use 'Secure' Attribute with Sensitive Cookie in HTTPS Session.CVE-2022-3174#209 credit toChuuAvoid leakage of the stack trace in the default error page.CVE-2022-3175#210 credit toChuuEnforce minimum and maximum password lengthCVE-2022-3175#211 credit toChuu2.4.1 (2022-09-08)This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.Add Clickjacking DefenseCVE-2022-3167credit totharunavulaDrop Ubuntu Hirsute & Impish (End-of-life)2.4.0 (2022-06-21)This new release brings a lot of improvement since the last version, multiple bug fixes
to make the application stable. A couple of new features to improve the overall
usability and a new security feature to block a brute force attack.Add RateLimit to login page and API to mitigate robots attacks #167Send email notification only ifemail-senderoption is defined to avoid raising exception in logs #176Support file restore cancellation without leavingrdiffweb-restoreprocess in<defunct>state #174Replacepython-ldapbyldap3a pure python implementation to avoid dependencies onsaslandldapbinaries #186Reffactor core module to allow better extendability and reusability #183Add support for Debian Bookworm #180Add support for Ubuntu Impish #175Add rdiff-backup version to administration viewRun unit test during Debian build packageRefresh repository list automatically when required #188 #189Fix error 500 displayed in status page #191Improve repository browsing speed by minimizing the number of I/O call #192Publish Docker image directly to DockerHub #144Add REST API to manage sshkeysBreaking changes:Ldap Password changes is not supported anymore.Ldap Check Shadow expire config is not supported anymore. It should be replace by a custom filter.Drop CentOS 7 and CentOS 8 support2.3.9 (2022-01-05)Maintenance release to fix minor issuesImprove date parsing forbackup.logto avoid printing exception in logs #170Return HTTP error 403 for invalid symlink to avoid returning a misleading HTTP 500 Server Error #168Show a user friendly error message when trying to create a new user with an existing username #169Handle repository without last-backup date during the notification process to ensure notifications are sent #171Replace CherryPystorage_typebystorage_classto avoid warning in logsUpdate code to avoid deprecation warning where applicableAdd Flake8 validation to improve code qualityRemove Ubuntu Groovy support2.3.8 (2021-12-01)Push all artefacts to nexus server including binaries and documentationFixChart.jsloading on Debian bullseye #164Update installation steps documentationImprove LDAP authentication to lookup entire directoryFix usage of--ldap-add-user-default-userrootto avoid error related to wrong encodingImprove authentication mechanicsAvoid raising an HTTP error 500 when login form receive invalid payloadMitigate open redirect vulnerability in login form2.3.7 (2021-10-21)To avoid backward compatibility issue, revert CSRF Token validationMitigate CSRF vulnerability using cookies withSameSite=LaxMitigate CSRF vulnerability by validating theOriginheader when a form is submitedImprove usage of WTForm for all form validationUpdate installation stepd for debian #162Build Ubuntu packages and publish them to our APT repo2.3.6 (2021-10-20)Broken build2.3.5 (2021-10-18)Mitigate CSRF vulnerability to user, ssh and repo management with CSRF Token2.3.4 (2021-09-20)Skip email notification ifemail-hostconfiguration is not provided #157Skip email notification when the new attribute value has the same value #159USE LDAPmailattribute when creating new user from LDAP directory #1562.3.3 (2021-09-10)Provide a new themeblueto match IKUS Soft colors #1582.3.2 (2021-09-07)Automatically update user's repository list based on user's home directory2.3.1 (2021-07-14)Update defaultsession-dirlocation to/var/lib/rdiffweb/sessionto avoid using/var/run#1482.3.0 (2021-07-06)Improve timezone handling to display date with local timezone using javascript #143Improve charts by replacing d3js by chartkick #122Replace the status view by something meaningful with chartkick #122Provide Docker image with Rdiffwebdocker pull ikus060/rdiffweb#55Fix file and folder sorting #1432.2.0 (2021-05-11)Debian package:Add rdiff-backup as dependencies to comply with Debian packaging rulesMultiple other fixed to control filesUse debhelper-compat (= 13)Use debhelper-compat (= 13)Run test during packagingCreate default folder/var/run/rdiffweb/sessionsto store user sessionUse ConfigArgPare for configuration to support configuration file, environment variables and arguments to configure rdiffweb #114Fix cache in localization moduleAddldap-add-default-roleandldap-add-default-userrootoption to define default value for role and user root when creating user from LDAP #125Support PostgreSQL database by replacing our storage layer by SQLAlchemy #126Fix to retrieve user quota only for valid user_root #135Add optiondisable-ssh-keysto disable SSH Key managementUse absolute URL everywhereAdd support forX-Forwarded-For,X-Forwarded-protoand other reverse proxy header when generating absolute URLDrop Debian Stretch supportImplement a new background scheduler using apscheduler #82Use background job to send email notification to avoid blocking web page loading #47Use background job to delete repository to avoid blocking web page loading #48Allow deleting a specific file or folder from the history usingrdiff-backup-delete#128Improve support forsession-dir#131Add optionadmin-passwordto define administrator password for better securityImprove performance of repository browsingAdd a new view to display logs of a specific repositoryAllow downloading the logDefine a default limit to graph statistics to make it display fasterFixget-quota-cmdoption to properly return a value2.1.0 (2021-01-15)Debian package: Remove dh-systemd from Debian build dependencies (https://bugs.debian.org/871312we)Improve Quota management:QuotaSetCmd,QuotaGetCmdandQuotaUsedCmdoptions could be used to customize how to set the quota for your environment.Display user's quota in User ViewDisplay user's quota in Admin ViewAllow admin to update user quota from Admin View whenQuotaSetCmdis defined.Allow admin to define user quota using human readable value (e.g.: GiB, TiB, etc.)Improve logging around quota managementImprove robustness when service is startingImprove robustness when repository has wrong permission defined (e.g.: when some files not readable)Add user id in Admin viewReplaceUserObject(1)by the actual username in log file to improve debugging2.0.0 (2020-12-04)Re-implement logic to update repositories views to remove duplicates and avoid nesting repo. #107Handle elapsed time of days in the graph. ThanksNathaniel van Diepencontributions.Rebrand all link to ikus-soft.comUpdate documentation to install rdiffwebRemove obsolete minify dependencyDrop support for python2Provide null translation if translation catalogues are not foundPass a LANG environment variable to rdiff-backup restore process to fix encoding issue #112Remove obsolete python shebangRemove execution bit (+x) on python modulesProvide--helpand--versiononrdiffwebexecutableImprove cherrypy version detectionDo not update translation files (.mo) during build1.5.0 (2020-06-24)This minor release introduce official support of rdiffweb on Debian Bullseye. It also includes some usability improvements.Change formatting of Last Backup date for "Updated 3 weeks ago" to ease the readabilityAdd support for Debian BullseyeAdd support for Python 3.8 (#104)Add warning in the users list view when a root directory is invalid (#30)Add options to control search depthness (#1)Print a warning in the log when the "DefaultTheme" value is not valid (#90)1.4.0 (2020-05-20)Thanks to our sponsor, this release introduce a feature to have better control over the user's permission by defining 3 different levels of privilege: Admin, Maintainer and User. This addition allows you to have better control on what your users can or can't do.Fix single repository discovery when a user's home is a rdiff-backup repository[SPONSORED] Add a new setting at the user level to define the user's role. Admin,
Maintainer and User. Admin are allowed to do everything. Maintainer are
allow to browse and delete repo. Users are only allowed to browse. #94Add "Powered by" in the web interface footer #91Display a nice error message when trying to delete admin user #93Introduce usage of wtforms and flash in admin users for better form validation. #96 #97Update French translation1.3.2 (2020-04-23)This minor releases fixed issues found while testing release 1.3.0.Fix lookup of executable rdiff-backup and rdiffweb-restore to search in current virtualenv firstFix repository view when multiple repo path are conflictingFix logging of rdiffweb-restore subprocess1.3.1 (2020-04-10)This minor release enforces security of the password stored in rdiffweb database to make use of a better encryption using SSHA.
Only new passwords will make use of the SSHA scheme.Enforce password encryption by using SSHA scheme #881.3.0 (2020-04-07)This release focuses on improving the restore of big archives. The download should be much faster to start. Major enhancement was made to offload the processing outside the web server. And all of this is still compatible with rdiff-backup v1.2.8 and the latest v2.0.0.Restore file and folder in a subprocess to make the download start fasterFix encoding of archive on Python3.6 (CentOS 7) by using PAX formatAdd support to restore files and folders using rdiff-backup2Remove obsolete dependenciespysqlite2Fix issue creating duplicate entries of repository in the database1.2.2 (2020-03-05)This release provides little improvement to the v1.2.x including official support of rdiff-backup v2.0.0.Enhance the repository to invite users to refresh the repository when the view is empty.Support rdiff-backup v2.0.0Deprecate support for cherrypy 4, 5, 6 and 7Improve loading of repository data (cache status and entries)Restore compatibility with SQLite 3.7 (CentOS7)Known issues:Filename encoding in tar.gz and zip file might not be accurate if you are running Python 3.6 (CentOS7)1.2.1 (2020-02-08)Little bug fix following the previous releaseFix 404 error when trying to access other users repo as adminFix logging format for cherrypy logs to matches rdiffweb formatAdd log rotation by default1.2.0 (2020-01-30)This release focus on improving the database layers for better extendability to add more type of data and to support more databases backend like postgresql in the near future.Add explicit testing for Debian Stretch & BusterChange the persistence layersMinimize number of SQL queriesAdd object lazy loadingAdd object data cachingFix bugs with SQLite <= 3.16 (Debian Stretch)1.1.0 (2019-10-31)This release focus on improving the admin area and building the fundation for repository access control list (ACL).Update documentation from PDSL web siteImprove the navigation bar layoutUpdate the login page headlineUpdate jinja2 version to allow 2.10.xShow server log in admin areaReduce code smellAdd System information in admin areaValidate credential using local database before LDAPReffactoring templates macrosEnhance user's view search barChange repository URL to username/repopathAdd System information in admin areaImprove testcasesClean-up obsolete codeFix issue with captital case encoding nameFix compilation of less filesFix google font import1.0.3 (2019-10-04)Removing the auto update repos1.0.2 (2019-10-01)Create "admin" user if missingUpdate french translation1.0.1 (2019-09-22)Update installation documentationFix removal of SSH KeyReturn meaningful error to the user trying to add an existing SSH key1.0.0 (2019-09-11)Make repository removal more robustImprove performance of librdiffAdd new RESTful apiReturn the right HTTP 401 or 402 error code for authenticationFix bug introduce by upgrade to Jinja2 + python3Store ssh keys in database and diskAdd support for theme (default, orange)Remove deprecated profiling codeAdd disk usage support / quotaAdd support of cherrypy v18Drop support of cherrypy v3.2.2Add wsgi entry pointReplace the plugins architecture to ease implementationNumerous bug fixes0.10.9 (2019-05-22)Better error handling when error.log file are not valid gzip file