This is basically what I've done, with the addition (which may have been
an unstated assumption) that the backuppclogin user on each client
machine has a disabled password, so that it can only be accessed via ssh
public key login, or by "sudo su [user]" on the local machine.
This is, IMO, "secure enough" for all practical purposes. Although the
backuppclogin user can, as you said, be used to read any information on
the machine via a properly-crafted "sudo rsync" command line, the only
ways that you can run a command as that user are if you either have root
on the client machine (in which case you can already read all its files)
or if you have cracked the master backuppc account on the bpc server to
gain access to its private ssh key (in which case you can already read
the client's files from the backup pool). In neither case does the
"read everything" rsync command give you anything you don't already have.
On 3/22/22 03:37, backu...@kosowsky.org wrote:
There are some things you can do to *partially* harden the situation,
While this might be particularly dangerous, but if you are going to backup
a machine fully then you will need at least root-like read access to all the
files on that machine.
Things to consider include:
1. Use sudo for the backuppc login user (say: 'backuppclogin') restricted only
to the specific
'backuppclogin' user and the /usr/bin/rsync string that is sent by backing
up
backuppclogin ALL=NOPASSWD: /usr/bin/rsync --server --sender
-slHogDtpAXrxe.iLsf, /usr/bin/rsync --server --sender -slHogDtpAXrcxe.iLsf
(note: this is not perfect as you still are able to read
*everything* root can and there might be ways to overload the above
strings to get even more access)
2. Use ssh-agent so that you can use an ssh-key with password though
you will need to add the key to the backuppc user keychain
3. I'm sure there are other things you can do with SELinux, ACLs etc
to be more restrictive of privileges...
Would be good to hear what others do here...
_______________________________________________
BackupPC-users mailing list
BackupPC-users@lists.sourceforge.net
List: https://lists.sourceforge.net/lists/listinfo/backuppc-users
Wiki: https://github.com/backuppc/backuppc/wiki
Project: https://backuppc.github.io/backuppc/
_______________________________________________
BackupPC-users mailing list
BackupPC-users@lists.sourceforge.net
List: https://lists.sourceforge.net/lists/listinfo/backuppc-users
Wiki: https://github.com/backuppc/backuppc/wiki
Project: https://backuppc.github.io/backuppc/
