In the message dated: Wed, 10 Jan 2007 10:39:22 GMT, The pithy ruminations from Martin Simmons on <Re: [Bacula-users] FD running as non-root> were: => >>>>> On Tue, 09 Jan 2007 16:52:41 -0500, Dan Langille said: => > => > This issue came up on IRC yesterday. The statement in question is at => > http://www.bacula.org/rel-manual/Bacula_Security_Issues.html : => > => > "The Clients (bacula-fd) must run as root to be able to access all => > the system files." => > => > Someone wanted to run FD as non-root. I replied that would be fine => > provided the UID/GID has permission to access all the files you want => > to backup. I propose to replace the quoted sentence with: => > => > "The Clients (bacula-fd) must run as whatever GID/UID is necessary to => > access whatever files you wish to backup. In addition, if you wish to => > restore over existing files, bacula-fd will require sufficient => > permission to do that. In most cases, this means root." => > => > Comments? => => Restore will also be limited for new files, always setting the owner to the => user that is running bacula-fd and similarly for the group.
Hmmm.... I'm strongly in favor of privilege separation, and I like the idea of running the fd as a non-root user (perhaps group "disk"?). Anyway, I wonder if this will introduce problems if the user who can read files cannot also create special attributes (ACLs, Linux immutable files, Solaris "door" files, device special files, etc.). There may be a lot of corner cases (very OS specific) that will require testing if the FD is run as a non-root user. Mark => => __Martin ---- Mark Bergman [EMAIL PROTECTED] System Administrator Section of Biomedical Image Analysis 215-662-7310 Department of Radiology, University of Pennsylvania http://pgpkeys.pca.dfn.de:11371/pks/lookup?search=mark.bergman%40.uphs.upenn.edu The information contained in this e-mail message is intended only for the personal and confidential use of the recipient(s) named above. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail, and delete the original message. ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
