System: fresh and updated ubuntu Xenial Xerus 16.04.2. Started from a clean minimal system where only openssh was installed. In order to install backuppc 3.3.2 i did the following:
apt-get install backuppc rsync libfile-rsyncp-perl par2 smbfs
Apt did the rest, installing dependencies such as apache2 and perl. If you think it might be important I'll edit the question and will paste relevant lines from apt logs.
After that, I did all the configurations needed to backup the first host, and after a few days I came back to the test lab to check how it was doing. I've got to say that backuppc is a beautiful piece of software and it did exactly - or even better than - what I expected!
I just noticed that on the home screen pool's graphs didn't display; troubleshooting returned me just one piece of information from the apache logs:
ERROR: opening '/var/lib/backuppc/log/pool.rrd': Permission denied
Definitely a permissions issue: /var/lib/backuppc is owned by backuppc:backuppc while apache runs under the www-data account.
Googleing for the error returned such fix:
Resource | Actual perms | Solution's perms
/var/lib/backuppc | 2750 | 2751
/var/lib/backuppc/log | 750 | 751
/var/lib/backuppc/log/pool.rrd | 640 | 754
These permissions changes fixed the issue, and now the graphs are displayed. Anyway I'm still concerned about the exposed service's security after the permission changes. In this case i'm planning an implementation in a secure and isolated environment, but what if the customer asks to expose the service, or worse if he exposes it by himself? I don't want to leave a potential security hole right where they will go for recovery if something goes wrong in the production environment.
Another solution might be to add backuppc's user to the www-data group, but that might be even worse from a security perspective.
Another solution might be to patch the code run by backuppc to handle such issue (and, maybe, some lines in the sudoers file) but I have no programming skills, nor I can read anything but bash scripting.
So my question is: Which one is the most secure solution in order to achieve graphs display?