Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

On our server we have a number of users (i.e. clients) who need their code to be backed up. Their file permissions are usually 650 with user and group being user:user (where user is the actual user name).

In crontab we have a user, backup, that backups all the desired file paths via tarsnap. The problem is that because of the file permissions, backup can't access these. I can think of four solutions:

  1. Set the cronjob to run as root. This is the easiest fix but I don't know if there is a security issue here.
  2. Create a group that all users we want to backup and backup belong to. Set the default permissions to set the group for all these users to that group...the backup group seems like a good choice for a group name. This seems a bit difficult though. How do I change the default permissions for each user so that each file touched has the user user and group backup?
  3. Modify the group permissions on all the files we want to backup. This is also easy but it also means every time a file is touched (i.e. modified or created) we'll have to modify the group. Not ideal.
  4. Make the files world-readable. Is this a security issue?

What would be a reasonable configuration so that I can easily backup these files?


Just thought of one more…

  1. Add the backup user to each of the user groups I wish to backup. This resolves the problem of shared access.

In doing some research, it seems like the semantics of /var/backups and the backup user are unclear. It doesn't seem dangerous to put backups in /var/backups but the recommendation there was not to use it for user backups since the behavior is undocumented (since 2001). Practically speaking, it seems that a lot of processes use /var/backups and the backup user ("user" is the wrong word to describe this though...since backup is not a proper "user" with a home directory, etc.) so in recommending its usage, we're not advocating something new.

share|improve this question

1 Answer 1

up vote 4 down vote accepted

I think you should really got with just running cronjob under root

Reasons:

  • You will avoid non-backed up files due to user setting permission to something like 700. For example ssh keys must have this permission or SSH refuses to use them if I remember correctly. When doing a backup under root you will always know that you copied all the files.

  • If you make users part of the same backup group, they will be able to access eachother's files. I think there are too many possible security issues caused by said reconfiguration to use backup group than to simply use cronjob for user root.

share|improve this answer
    
+1 from me. Backup is a system function; under UNIX, those are supposed to happen as root. –  MadHatter Mar 25 at 9:24
    
@edvinas.me What do you think of my last possible solution (above) that I just added? –  Avery Chan Mar 26 at 1:29
    
After some thinking, this is the right answer. –  Avery Chan Apr 3 at 1:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.