Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a central backup server running Debian which holds backups of various other hosts in the network, stored in a structure like

/media/backup/imap
/media/backup/wiki

With imap and wiki being hosts on our network. Right now, all files beneath /media/backup are owned by root:backup with 0750 permissions. What's annoying about this is that

  1. Every member of the backup user group can read all backups, including those of sensitive data (say: mails).
  2. Right now one of the administrator accounts (jim@backup) is used for restoring the backups. It's annoying that this functionality is bound to a particular user.

Does this setup make sense? If it doesn't, what's a better approach for organizing backups? One solution I've been considering is to have different system users per host, so there's e.g. imap@backup and wiki@backup. The files beneath /media/backup/imap would then be owned by imap:imap with 0700 permissions.

share|improve this question
    
When you restore from these backups, how do you restore the owners/permissions? –  nickgrim Oct 29 '12 at 11:25
    
@nickgrim: We just force the permissions using chown -R and chmod -R right now, i.e. whatever permission/ownership is backed up, it's not used. –  Frerich Raabe Oct 29 '12 at 11:48
1  
Oof, that sounds like it has the potential to cause exciting issues further down the line. I'd strongly recommend a backup solution that preserves permissions too, e.g. the one in @maikel-van-leeuwen's answer. –  nickgrim Oct 29 '12 at 11:52
    
@nickgrim: It's not as bad as it sounds: for instance, the imap host only contains the IMAP server. We only back the /home/vmail directory (beneath which the Maildirs of our users live), all all data in there is already owned by vmail:vmail. Of course we wouldn't just force the same permissions on all files on a complete system. ;-) However, what I was trying to get at is: what permissions should we use on the backup server. –  Frerich Raabe Oct 30 '12 at 8:43
add comment

1 Answer

Then use rdiff-backup. This keeps the permissions

http://www.nongnu.org/rdiff-backup/features.html

Preserves all information: Whether you restore from the mirror directory or from an earlier incremental backup, rdiff-backup will reproduce your files exactly as they were. Files >missing at the time of backup will also be missing after the restore. Files hard linked when >backed up will be hard linked after the restore. rdiff-backup also preserves permissions, >user and group ownership, modification time, device files, fifos, and symlinks.

share|improve this answer
    
For restoring see nongnu.org/rdiff-backup/examples.html easy peasy. –  Maikel van Leeuwen Oct 29 '12 at 12:21
    
Sorry, my question was imprecise: the backups of e.g. imap are already just backups of (in this case) the Maildir directories, which all belong to vmail:vmail on the imap host anyway. Keeping the permissions means that we copy the uid/gid which may or may not be the same when the system is restored. I'm rather interested in the permissions on the backup server itself, i.e. should all backups get owned by one user or not? –  Frerich Raabe Oct 30 '12 at 8:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.