1

I have a central backup server running Debian which holds backups of various other hosts in the network, stored in a structure like

/media/backup/imap
/media/backup/wiki

With imap and wiki being hosts on our network. Right now, all files beneath /media/backup are owned by root:backup with 0750 permissions. What's annoying about this is that

  1. Every member of the backup user group can read all backups, including those of sensitive data (say: mails).
  2. Right now one of the administrator accounts (jim@backup) is used for restoring the backups. It's annoying that this functionality is bound to a particular user.

Does this setup make sense? If it doesn't, what's a better approach for organizing backups? One solution I've been considering is to have different system users per host, so there's e.g. imap@backup and wiki@backup. The files beneath /media/backup/imap would then be owned by imap:imap with 0700 permissions.

4
  • When you restore from these backups, how do you restore the owners/permissions?
    – nickgrim
    Oct 29 '12 at 11:25
  • @nickgrim: We just force the permissions using chown -R and chmod -R right now, i.e. whatever permission/ownership is backed up, it's not used. Oct 29 '12 at 11:48
  • 1
    Oof, that sounds like it has the potential to cause exciting issues further down the line. I'd strongly recommend a backup solution that preserves permissions too, e.g. the one in @maikel-van-leeuwen's answer.
    – nickgrim
    Oct 29 '12 at 11:52
  • @nickgrim: It's not as bad as it sounds: for instance, the imap host only contains the IMAP server. We only back the /home/vmail directory (beneath which the Maildirs of our users live), all all data in there is already owned by vmail:vmail. Of course we wouldn't just force the same permissions on all files on a complete system. ;-) However, what I was trying to get at is: what permissions should we use on the backup server. Oct 30 '12 at 8:43
1

Then use rdiff-backup. This keeps the permissions

http://www.nongnu.org/rdiff-backup/features.html

Preserves all information: Whether you restore from the mirror directory or from an earlier incremental backup, rdiff-backup will reproduce your files exactly as they were. Files >missing at the time of backup will also be missing after the restore. Files hard linked when >backed up will be hard linked after the restore. rdiff-backup also preserves permissions, >user and group ownership, modification time, device files, fifos, and symlinks.

2
  • For restoring see nongnu.org/rdiff-backup/examples.html easy peasy. Oct 29 '12 at 12:21
  • Sorry, my question was imprecise: the backups of e.g. imap are already just backups of (in this case) the Maildir directories, which all belong to vmail:vmail on the imap host anyway. Keeping the permissions means that we copy the uid/gid which may or may not be the same when the system is restored. I'm rather interested in the permissions on the backup server itself, i.e. should all backups get owned by one user or not? Oct 30 '12 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.