I’ve set up a static ssh tunnel which seem to work perfectly with Duplicati/Minio. When thinking about it I realized that a proxy was overkill for what I wanted to accomplish 
Yeah, I needed to polish up my skills on ssh a little, hehe.
Currently I’m preloading the to be remote server locally before I ship it over to the of site location. Fancy name for “my friends house” 
Just a quickly copied raw todo list collected from different places and tested succesfully on Debian 9. If anyone is interested. Note: This is with an encrypted ssh tunnel and not an ssh proxy.
On Linux server with Minio:
sudo mkdir -p /opt/minio/configs/main
sudo mkdir -p /backupstorage/main or somewhere else with lots of storage space
sudo chown -R <your backup user>:<your backup user group> /opt/minio/
sudo chown -R <your backup user>:<your backup user group> /backupstorage/
cd /opt/minio
wget https://dl.minio.io/server/minio/release/linux-amd64/minio
chmod +x minio
sudo nano /etc/systemd/system/minio-main.service
[Unit]
Description=Minio Main
[Service]
User=<your backupuser>
ExecStart=/opt/minio/minio server --address 0.0.0.0:9000 --config-dir /opt/minio/configs/main /backupstorage/main
[Install]
WantedBy=multi-user.target
sudo systemctl daemon-reload
sudo systemctl enable minio-main.service
sudo systemctl start minio-main.service
sudo systemctl status minio-main.service
sudo tail -n 3000 /var/log/syslog | grep "minio" NOTE: copy and save the two keys you see!
Now you need to create a “bucket” (storage area) in Minio for Duplicati to use. Surf to your Minio Linux box:
<ip number or fqdn for your backup server>:9000
and add a bucket. Easiest is to surf to this address while being on the same LAN so you don’t have to hassle with reaching it through a firewall. To reach it AT ALL from remote using ssh you MUST have port 22 open in the firewall at it’s location. To surf to the Minio web interface you need to have port 9000 open (you can choose another port when setting up Minio as above). If you can’t have any ports open whatsoever to the Linux/Minio server read my paragraph at the bottom of this post.
On windows computer with Duplicati to run backup job
- Download and install 64x cygwin from www.cygwin.com
- During install you choose and add two extra non default packages by searching for “ssh” and add:
As Administrator account, in cygwin terminal/shell write:
ssh-keygen -t rsa -b 4096
choose blank passphrase
save in /home/Administrator/.ssh/id_rsa
ssh-copy-id -i /home/Administrator/.ssh/id_rsa.pub <your servers backup user>@<ip number or fqdn for your backup server>
TEST 1. You should now auto login without password using your local secret key:
ssh -i /home/Administrator/.ssh/id_rsa.pub <your servers backup user>@<ip number or fqdn for your backup server>
exit
TEST 2:
autossh -M 0 -i /home/Administrator/.ssh/id_rsa -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -N -L 9000:localhost:9000 <your servers backup user>@<ip number or fqdn for your backup server> -v
ctrl-c
CREATE AS SERVICE so the tunnel is always up:
cygrunsrv -I Autossh-MINIO-tunnel -p /usr/bin/autossh -a "-M 0 -i /home/Administrator/.ssh/id_rsa -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -N -L 9000:localhost:9000 <your servers backup user>@<ip number or fqdn for your backup server>" -e AUTOSSH_GATETIME=0
In windows services edit the Autossh-MINIO-tunnel service:
Run as user Administrator + it's password
In Duplicati when setting up your backup jobs
On the destination page:
Storage type: S3 compatible
Server: Custom server url
<your servers backup user>@localhost -p 9000
Don't enable Use SSL
Use the two keys you copied earlier from the server as AWS Access keys
Enable s3-ext-forcepathstyle under advanced settings
When all is running fine you can secure your ssh server a bit by editing this ON THE BACKUP LINUX server:
sudo nano /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
.
Oh, one more thing. If you want to backup many different computers to your remote Linux/Minioserver you don’t have to set up and run a ssh tunnel on each computer! You just set up one computer to run the tunnel and have all the others use that tunnel. You just need to add the option to share the tunnel by adding this to the command line starting autossh “-o GatewayPorts=yes” like this:
TEST:
autossh -M 0 -i /home/Administrator/.ssh/id_rsa -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o GatewayPorts=yes -N -L 9000:localhost:9000 <your servers backup user>@<ip number or fqdn for your backup server> -v
CREATE AS SERVICE so the tunnel is always up:
cygrunsrv -I Autossh-MINIO-tunnel -p /usr/bin/autossh -a "-M 0 -i /home/Administrator/.ssh/id_rsa -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o GatewayPorts=yes -N -L 9000:localhost:9000 <your servers backup user>@<ip number or fqdn for your backup server>" -e AUTOSSH_GATETIME=0
.
Oh right, just another thing: If you have no option whatsoever to have ANY open ports in the firewall at the remote site where you placed your Linux/Minio server, you can let it “call home” to you instead. This will not be stopped by any normally set up firewall (outgoing traffic allowed, incoming restricted). You will however have to open a port in your local firewall. To get the remote computer to “call home” you just set up one more ssh tunnel (a “reverse” tunnel) quite similar to above but this time you start the client ssh tunnel on your Linux/Minio server and have the ssh server deamon running on your local computer. This is how I run it actually. If anyone is interested just give me a holler.
.
As someone said, it might be easier to set up with just sftp instead of Minio. But where is the fun in that?
.
/Magnus
So that works.
