Re: backups: best privilege policy

2006-08-14 Thread Henning Brauer
* Jacob Yocom-Piatt <[EMAIL PROTECTED]> [2006-08-12 18:06]: > i have a script that runs on a single backup host and gathers dumps from other > machines on the network by ssh-ing into them as root using pubkey > authentication. allowing root access via ssh is, of course, not a good idea. > is > the

Re: backups: best privilege policy

2006-08-12 Thread Nick Holland
Jacob Yocom-Piatt wrote: i have a script that runs on a single backup host and gathers dumps from other machines on the network by ssh-ing into them as root using pubkey authentication. allowing root access via ssh is, of course, not a good idea. The "of course" part is dubious actually. If yo

Re: backups: best privilege policy

2006-08-12 Thread Matthew Weigel
Jacob Yocom-Piatt wrote: > i have a script that runs on a single backup host and gathers dumps from other > machines on the network by ssh-ing into them as root using pubkey > authentication. allowing root access via ssh is, of course, not a good idea. > is > there an established method for keepin

Re: backups: best privilege policy

2006-08-12 Thread Pierre-Yves Rofes
Jacob Yocom-Piatt wrote: > i have a script that runs on a single backup host and gathers dumps from > other > machines on the network by ssh-ing into them as root using pubkey > authentication. allowing root access via ssh is, of course, not a good > idea. is > there an established method for keepi

Re: backups: best privilege policy

2006-08-12 Thread Antoine Jacoutot
On Sat, 12 Aug 2006, Jacob Yocom-Piatt wrote: any feedback on these ideas is appreciated. If you're using dump, then you could add un unpriviledged user and add it to the operator group. Cheers. -- Antoine

Re: backups: best privilege policy

2006-08-12 Thread Martin Schröder
2006/8/12, Jacob Yocom-Piatt <[EMAIL PROTECTED]>: i have a script that runs on a single backup host and gathers dumps from other machines on the network by ssh-ing into them as root using pubkey authentication. allowing root access via ssh is, of course, not a good idea. is there an established m