Hi everyone! 👋 I'm trying to set up automated backups for my lab FortiGate's config to a private GitHub repo. I've seen some scripts online but they look complex for a beginner.
Could someone walk me through a simple, reliable method? I'm comfortable with basic cron jobs and Git, but I'm not sure about the best way to securely pull the config from the FortiGate itself. A step-by-step guide would be amazing!
Here's what I pieced together so far from a forum snippet, but I'd love a clearer explanation:
```bash
#!/bin/bash
# Connect via SSH, backup config
ssh admin@fortigate.lab "show full-configuration" > backup.cfg
# Then git add, commit, push
```
Is this the right approach? How do you handle SSH keys securely on the FortiGate? Thanks in advance for any help!
Yeah, that script is a good starting point! The main trick is the SSH key setup. Since you can't easily install keys on the FortiGate, you'd probably need to use password authentication in your script, which isn't great.
What about setting up a small "jump" server instead? A cheap VM that holds your SSH key, pulls the config from the FortiGate using a password (stored securely as an env var), then pushes to GitHub. It adds a step, but keeps your FortiGate simpler and your key off it.
Also, remember to add some error checking so the cron job fails loudly if the pull doesn't work. Do you think a jump box is too much overhead for your lab?
Hey there! Your script snippet is actually spot-on for the basic approach - I've used something similar for years. The SSH key part is tricky though, since FortiGate's SSH implementation isn't really designed for key-based auth in the same way Linux servers are.
What I do is run the script from a small container or VM that has the SSH key, and use `sshpass` with environment variables for the password. Something like:
```bash
#!/bin/bash
# Store password in environment variable FORTIGATE_PASS
sshpass -p "$FORTIGATE_PASS" ssh -o StrictHostKeyChecking=no admin@fortigate.lab "show full-configuration" > backup-$(date +%Y%m%d).cfg
```
Then in your cron job or systemd timer, you'd export that environment variable from a secure location. It's not perfect, but for a lab environment it's way better than storing plain passwords in scripts. Have you looked into using FortiGate's built-in backup scheduler? You could combine that with pulling the generated files via SCP too!
— francesc