Ask HN: Should I Use the Root User for Backing Up Linux Server?

#1

Post by EyebrowsWhite » Wed, Jun 05, 2024, 3:29 AM UTC

When doing partial backups (e.g., /etc, /home, /data), is it better to create a dedicated user for backups or to use the root user?

Currently, I'm using a dedicated user with ACL permissions, but I've run into two issues:

1. Some files, like the private keys in /etc/ssh, need to have permissions set to 600. Forcing ACLs changes permissions to 640, making SSH login impossible.

2. After setting ACL permissions on a directory, newly added files don't retain those ACL permissions.

Using the root user seems to provide excessive permissions. How do you handle this in your practice?

Re: Ask HN: Should I Use the Root User for Backing Up Linux Server?

#2

Post by talldayo » Wed, Jun 05, 2024, 3:37 AM UTC

> How do you handle this in your practice?

Create a normal user, make them a sudoer, and then log back in as the other account.

Re: Ask HN: Should I Use the Root User for Backing Up Linux Server?

#3

Post by stop50 » Wed, Jun 05, 2024, 3:41 AM UTC

most backup programs run with root or at the targets own user. There is the possibility to circumvent the permission checks: capabilities. the provide parts of the root user to unprivileged processes, in your case CAP_DAC_READ_SEARCH should be enough for the backup process itself. for restore it would need a bumch of caps set, like CAP_DAC_OVERRIDE, CAP_CHOWN and maybe more

Re: Ask HN: Should I Use the Root User for Backing Up Linux Server?

#4

Post by elmerfud » Wed, Jun 05, 2024, 3:43 AM UTC

I use a dedicated backup user, and setfacl does allow inheritance of its acl on newly created things. I can't look it up now but I'm sure a Google search will find it. It can also prevent the 640 as well because those acls are different than the normal mask.

I think what you might be doing is applying a group acl instead of a user acl. In my setup I use normal Unix group permissions for some things, acls that apply group permissions for most things, but for homes I put my backup account as acl user permissions for read.

Could you use root? Sure, but you would need to evaluate the risk in that. As root is "do all the things" account. The backup account can still read all the things so you still have data loss exposure but it can't modify the things.

Re: Ask HN: Should I Use the Root User for Backing Up Linux Server?

#5

Post by EyebrowsWhite » Wed, Jun 05, 2024, 7:45 AM UTC

elmerfud wrote: post #4

I use a dedicated backup user, and setfacl does allow inheritance of its acl on newly created things. I can't look it up now but I'm sure a Google search will find it. It can also prevent the 640 as well because those acls are different than the normal mask. I think what you might be doing is applying a group acl instead of a user acl. In my setup I use normal Unix group permissions for some things, acls that apply g…

I have found the inheritance method, just add `-d` option.

But I can't find the way to prevent 640. I know it's not really read by all others, but sshd will prevent login with error `error: Permissions 0640 for '/etc/ssh/ssh_host_rsa_key' are too open.`. I have tried a lot of commands, but still can't resolve this.