Configuration backup

Config backup signs in to your routers, switches and firewalls over SSH, every day by default, and reads their configuration. It keeps a new version whenever a configuration changes, shows what changed between any two versions, and warns you about changes and about backups that keep failing. It is off until an admin turns it on, and it only ever reads.

Before you start

• OpenSSH on the collector. The Monitaria appliance has it; on Debian or Ubuntu, install it with sudo apt install openssh-client. The Status tab says when it's missing.
• A backup account on your devices that can read the whole configuration but change nothing. For example: a privilege 15 user on Cisco IOS (or a lower one plus the enable password), a non-root user in a read-only class with view-configuration on Junos, or an administrator profile with read access on FortiGate.

Set it up

1. Open Settings › Credentials and add a credential of the kind SSH (network devices): the User name, a Password or a Private key (no passphrase), an Enable password if your devices need one, and the SSH port.
2. Open Settings › Config backup, choose the Settings tab and tick Turn on config backup.
3. Under Which devices, tick the device types to back up: routers, switches and firewalls by default. Under Credentials, pick the SSH credential for every device, and another one per site if you need to. Choose Save settings.
4. Devices that have never been backed up are backed up within a minute. After that, backups run every day at 02:00 collector time unless you change When and At.
5. Open the Status tab. A device marked Needs setup says what's missing, usually a vendor profile Monitaria couldn't detect, or an address. Fix it with Settings on that row.
6. Back on the Settings tab, under Alerts, choose Add backup checks to … devices. Each backed-up device gets a Configuration backup sensor that checks every 5 minutes, so changes and failed backups reach people through your alert rules.

Monitaria detects each device's vendor profile from what the device reports about itself, such as its SNMP description, and takes its address from its sensors, starting with ping. Profiles cover Cisco IOS and IOS-XE, NX-OS and ASA, FortiGate, Aruba / HP AOS-S and Aruba CX, Ubiquiti EdgeOS and UniFi, Juniper Junos, MikroTik RouterOS and Palo Alto PAN-OS. For anything else, open Settings on the device's row, choose Other device: run my command and enter a command that prints the configuration, such as show running-config.

Tip: Backups only read. Commands that would change or restart a device (reload, write, copy, configure, commit and the like), chain another command or write a file are refused.

See what changed

• Each device's dialog has a Configuration section with its versions, newest first. What changed compares a version with the one before; to compare any two, pick them under From and To and choose Compare, in Unified or Side by side layout. View and Download show a single version.
• The Status tab lists Recent changes from the last 7 days, each with What changed. Back up now backs up one device straight away, and Back up all now does every device.
• The Configuration backup sensor goes Down after 3 failed backups in a row. It is Warning for 24 hours after a change (Keep warning for), after a failed backup, and when there has been no successful backup for two days on a daily schedule. Otherwise it is Up.
• Each device's timeline shows its first backup, every change and the start of a run of failed backups.
• With syslog set up and the suggested Configuration changed rule saved, a device is also backed up about two minutes after it logs a configuration change. This is the option Also back up a device a few minutes after its log shows a configuration change, on by default.

How it keeps things safe

• Passwords, hashes, keys and SNMP communities are hidden in every view and comparison, shown as a tag such as <hidden:1a2b3c>. The tag stays the same while the value does, so you still see that a secret changed.
• Only an admin can tick Show passwords and keys. Each time is recorded in the audit log, and so is every download.
• Credentials are write-only: kept on the collector, never shown again and never put on a command line. Configurations stay on the collector too.
• Host keys are pinned. If a device presents a different SSH host key, its backups stop until an admin compares the fingerprint with the device's console and chooses Accept new key or Forget key on the Host keys tab.
• Who can read configurations is set to Operators and admins by default. Other people see backup status and versions for their devices, not the text, and API tokens never get configurations.

Good to know

• Restoring is up to you: download a version and load it on the device yourself.
• SSH only, straight from the collector to each device: no Telnet, no file copies and no jump hosts.
• Private keys can't have a passphrase, and a sign-in that asks for a one-time code isn't supported. Password sign-in needs a Linux or macOS collector.
• FortiGate shows encrypted values differently on every read, so they're ignored when comparing; a change to an encrypted secret alone doesn't make a new version.
• MikroTik RouterOS 7 leaves passwords out unless the device's command says show-sensitive. UniFi devices hold only part of their settings; the controller has the rest.
• Hiding secrets works by pattern, so an unusual syntax may show a value. By default each device keeps up to 100 versions for up to 365 days, and always keeps its newest one.