Duplicity备份至Amazon S3遇SSLEOFError问题求助

问题背景 #

• 环境：Ubuntu 22.04.4 LTS（内核5.15.0-116-generic）、Duplicity 0.8.21
• 异常现象：约1TB的大目录备份时，卷文件（命名格式duplicity-full.<YYYYMMDD>1T<hhmmss>Z.vol<X>.difftar.gpg）可正常上传至S3存储桶，但签名文件（命名格式duplicity-full-signatures.<YYYYMMDD>1T<hhmmss>Z.sigtar.gpg）上传触发SSL连接错误，重试5次后终止，S3中无该签名文件；小目录备份无此问题。

错误日志 #

Backtrace of previous error: Traceback (innermost last):
  File "/usr/lib/python3/dist-packages/duplicity/backend.py", line 387, in inner_retry
    return fn(self, *args)
  File "/usr/lib/python3/dist-packages/duplicity/backend.py", line 574, in move
    self.__do_put(source_path, remote_filename)
  File "/usr/lib/python3/dist-packages/duplicity/backend.py", line 544, in __do_put
    self.backend._put(source_path, remote_filename)
  File "/usr/lib/python3/dist-packages/duplicity/backends/_boto_single.py", line 265, in _put
    self.upload(source_path.name, key, headers)
  File "/usr/lib/python3/dist-packages/duplicity/backends/_boto_single.py", line 319, in upload
    key.set_contents_from_filename(filename, headers,
  File "/usr/local/lib/python3.10/dist-packages/boto/s3/key.py", line 1375, in set_contents_from_filename
    return self.set_contents_from_file(fp, headers, replace, cb,
  File "/usr/local/lib/python3.10/dist-packages/boto/s3/key.py", line 1307, in set_contents_from_file
    self.send_file(fp, headers=headers, cb=cb, num_cb=num_cb,
  File "/usr/local/lib/python3.10/dist-packages/boto/s3/key.py", line 760, in send_file
    self._send_file_internal(fp, headers=headers, cb=cb, num_cb=num_cb,
  File "/usr/local/lib/python3.10/dist-packages/boto/s3/key.py", line 957, in _send_file_internal
    resp = self.bucket.connection.make_request(
  File "/usr/local/lib/python3.10/dist-packages/boto/s3/connection.py", line 667, in make_request
    return super(S3Connection, self).make_request(
  File "/usr/local/lib/python3.10/dist-packages/boto/connection.py", line 1070, in make_request
    return self._mexe(http_request, sender, override_num_retries,
  File "/usr/local/lib/python3.10/dist-packages/boto/connection.py", line 1030, in _mexe
    raise ex
  File "/usr/local/lib/python3.10/dist-packages/boto/connection.py", line 939, in _mexe
    response = sender(connection, request.method, request.path,
  File "/usr/local/lib/python3.10/dist-packages/boto/s3/key.py", line 856, in sender
    http_conn.send(chunk)
  File "/usr/lib/python3.10/http/client.py", line 999, in send
    self.sock.sendall(data)
  File "/usr/lib/python3.10/ssl.py", line 1266, in sendall
    v = self.send(byte_view[count:])
  File "/usr/lib/python3.10/ssl.py", line 1235, in send
    return self._sslobj.write(data)
 ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:2426)

Attempt of move Nr. 1 failed. SSLEOFError: EOF occurred in violation of protocol (_ssl.c:2426)

排查思路 #

• 网络稳定性排查：仅大文件上传失败，优先检查路由器/防火墙的长连接超时设置、MTU值是否适配S3网络，是否存在网络波动导致SSL连接中途断开。
• 依赖版本兼容性：当前使用的旧版boto库（非boto3）与Duplicity 0.8.21的组合，可能对大文件S3上传的SSL处理存在缺陷。
• Duplicity参数配置：默认的上传分块大小、重试次数、超时时间可能不足以支撑大文件上传。

解决方法 #

1. 优化网络TCP参数 #

编辑系统sysctl配置，增强长连接稳定性：

echo "net.ipv4.tcp_keepalive_time = 600" | sudo tee -a /etc/sysctl.conf
echo "net.ipv4.tcp_keepalive_intvl = 60" | sudo tee -a /etc/sysctl.conf
echo "net.ipv4.tcp_keepalive_probes = 5" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

同时检查路由器MTU值，建议设置为1450，或禁用TCP分段卸载（TSO）功能。

2. 升级Duplicity与替换依赖库 #

• 升级Duplicity到最新稳定版：

sudo apt update && sudo apt upgrade duplicity

• 卸载旧版boto，安装boto3（Duplicity 0.8.x支持boto3后端，更适配S3 API）：

sudo pip3 uninstall boto && sudo pip3 install boto3

备份时指定使用boto3后端：

duplicity --backend boto3 [你的备份源] s3://[存储桶路径]

3. 调整Duplicity上传参数 #

• 增大S3多部分上传分块大小（减少连接次数）：

duplicity --s3-multipart-chunk-size 100 [你的备份源] s3://[存储桶路径]

（单位为MB，默认值较小，大文件分块越多越易触发连接问题）

• 增加重试次数与超时时间：

duplicity --retries 10 --timeout 300 [你的备份源] s3://[存储桶路径]

4. 临时SSL兼容调整（仅测试用） #

若确认是SSL版本兼容问题，可临时降低SSL安全级别（不推荐生产环境）：

export SSL_CIPHERS='DEFAULT:@SECLEVEL=1'
duplicity [你的备份参数]

内容的提问来源于stack exchange，提问作者pallago