Simplify Acronis Agent Installations: Automation and Protection Plan Integration

./Cyber_Protection_Agent_for_Windows_x64.exe --help

sudo ./Cyber_Protection_Agent_for_Linux_x86_64.bin --help

POST /api/2/tenants/65f92900-6cb2-499e-ac3b-39421b350eeb/registration_tokens

Content-Type: application/json 

{

	"expires_in": 259200,

	"scopes": [

		"urn:acronis.com:tenant-id:1628fcea-554e-4d57-9715-30a42b9d1451:backup_agent_admin",

		"urn:acronis.com::policy_management:1952007|dada2e75-2875-4565-88c6-53f2e4bf9b67:apply_revoke"

	]

}

.\Cyber_Protection_Agent_for_Windows_x64.exe --quiet --registration by-token --reg-token $regToken --reg-address $baseUrl

# read recource id from registry

$resourceId = Get-ItemProperty -Path "HKLM:\SOFTWARE\Acronis\BackupAndRecovery\Settings\MachineManager" | Select-Object -ExpandProperty InstanceID

# At first we need to exchange registration token to an authorization token

# Use param to tell type of credentials we request

$postParams = @{ grant_type = "urn:ietf:params:oauth:grant-type:jwt-bearer&assertion" ; assertion = $regToken}

# Set the content type

$headers = @{ Content-Type = "application/x-www-form-urlencoded"}

# Exchanhe the token

$token = Invoke-RestMethod -Method Post -Uri "${baseUrl}bc/idp/token" -Headers $headers -Body $postParams

$accessToken = $token.access_token

# Body JSON, to apply policy included into the registration token

# policy id doesn't need as it included into the installation token

$json = @"

{

	 "context": {

		 "items": [

			 "${resourceId}"

		 ]

	 }

}

"@

$bearerAuthValue = "Bearer $accessToken"

$headers = @{ "Authorization" = $bearerAuthValue }

$headers.Add("Content-Type", "application/json")

$result = Invoke-RestMethod -Method Post -Uri "${baseUrl}api/policy_management/v4/applications" -Headers $headers -Body $json

export HISTIGNORE='*sudo -S*'

echo "" | sudo -S -k ./Cyber_Protection_Agent_for_Linux_x86_64.bin -a --rain "${_base_url}"  --token "${_reg_token}"

# You need appropriate right to read /etc/Acronis/BackupAndRecovery.config file

# Put resource id to the file for the script debug simplicity

while _read_dom; do

    _parse_dom

done < /etc/Acronis/BackupAndRecovery.config > ~/resourceId.txt

# Put resource id into the variable

_resource_id=$(cat ~/resourceId.txt | sed -e 's/^"//' -e 's/"$//';)

# Exchange registration token to authorization token

_post_api_call_bearer_urlencoded "bc/idp/token" \

					"application/x-www-form-urlencoded" \

					"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer"  \

					"assertion=${_reg_token}"  \

					 > ~/access_token.json

# Get access_token from file

_access_token=$(_get_access_token_from_file "~/access_token.json")

# Construct JSON to apply a protection plan

_json='{

     "context": {

         "items": [

             "'$_resource_id'"

         ]

     }

}'

# To apply a protection plan

# POST API call using function defined in basis_functions.sh

# with following parameters

# $1 - an API endpoint to call

# $2 - Content-Type

# $3 - POST data

# The result is stored in results.json file

_post_api_call_bearer "api/policy_management/v4/applications" \

					"application/json" \

					"${_json}" > "~/results.json"

Below you can find helper functions used in the script above.

# XML config file needs to be parsed to find resource id

# We will use a simple example from https://stackoverflow.com/questions/893585/how-to-parse-xml-in-bash

# As it's well documented in that post 

_read_dom () {

    local IFS=\>

    read -d \< ENTITY CONTENT

    local RET=$?

    TAG_NAME=${ENTITY%% *}

    ATTRIBUTES=${ENTITY#* }

    return $RET

}

# Read config file, find value tag with name InstanceID and echo CONTENT

_parse_dom () {

    if [[ $TAG_NAME = "value" ]] ; then

        eval local $ATTRIBUTES

        if [[ $name = "InstanceID" ]] ; then

            echo $CONTENT

            exit

        fi

     fi

}

# Below you can find some helper functions to call Acronis REST API

# Print errors info to STDERR and exit execution

_die() { printf ":: %s\n\n" "$*" >&2; exit 1; }

# Pipe JSON from file, extract JSON property, remove quotas from the property's value

_get_access_token_from_file(){ jq '.access_token' < "${1}" | sed -e 's/^"//' -e 's/"$//'; }

# POST API call with Bearer Authentication

# $1 - an API endpoint to call

# $2 - Content-Type

# $3 - urlencoded data 1st param

# $4 - urlencoded data 2st param

_post_api_call_bearer_urlencoded () {

  local _response_body

  local _response_code

  curl	-s \

		-X POST \

		--url "${_base_url}${1}" \

		-H "Authorization: Bearer ${_access_token}" \

		-H "Accept: application/json" \

		-H "Content-type: ${2}" \

		--data-urlencode "${3}" \

		--data-urlencode "${4}" \

		-w "\n%{http_code}" | {

			read -r _response_body

			read -r _response_code

			_response "${_response_body}"

			if [[ $_response_code = 20* ]] ; then

  				echo "${_response_body}"

			else

				_die "The POST API Call with the endpoint ${1} is unsuccessful with response code: ${_response_code}." "${_response_body}"

			fi

		}

}

# POST API call with Bearer Authentication

# $1 - an API endpoint to call

# $2 - Content-Type

# $3 - POST data

_post_api_call_bearer () {

  local _response_body

  local _response_code

  curl	-s \

		-X POST \

		--url "${_base_url}${1}" \

		-H "Authorization: Bearer ${_access_token}" \

		-H "Accept: application/json" \

		-H "Content-type: ${2}" \

		--data-raw "${3}" \

		-w "\n%{http_code}" | {

			read -r _response_body

			read -r _response_code

			_response "${_response_body}"

			if [[ $_response_code = 20* ]] ; then

  				echo "${_response_body}"

			else

				_die "The POST API Call with the endpoint ${1} is unsuccessful with response code: ${_response_code}." "${_response_body}"

			fi

		}

}