分类: LINUX
2005-08-22 16:38:11
If you have multiple disks, some reserved for BackupPC, then it makes sense to backup the remaining disks to BackupPC.
Even if you haven't installed dedicated disks for BackupPC's data, backing up the non-BackupPC parts of your file systems provides protection from inadvertently deleted data.
The three issues are:
In some case, although not likely, you might need to set to 'localhost' if the XferMethod can't contact the host by regular host name.
Daniel Poelzleithner suggests the alternative of using sudo, so there is no overhead with ssh. For example:
= '/usr/bin/sudo $tarPath -c -v -f - -C $shareName+ --totals';
Then run visudo to give BackupPC permission to run sudo without a password, but only be able to run the /bin/tar command. For example, add this line:
backuppc ALL = NOPASSWD: /bin/tar
Note that an attacker who can become the backuppc user can then use sudo to run /bin/tar as root. Importantly, this means they can write files anywhere on the file system by doing tar -x. This allows them to become root.
If you want to be more cautious, you could create a short shell script (eg: tarCreate) that includes the create argument arguments from , eg:
#!/bin/sh -f
exec /bin/tar -c $*
Make sure this script and all parent directories have no write permission. Then remove the -c from and change the tar path:
= '/usr/bin/sudo /path/to/tarCreate -v -f - -C $shareName+ --totals';
Finally, run visudo to change the allowed command to /path/to/tarCreate.
In this case, a compromise of the backuppc user still allows the attacker to run tar -c. But this only allows them read access to files on the server, which they already have access to simply by inspecting the BackupPC backup data directories.
A similar setup with sudo can be used for rsync. See the SSH FAQ for more information.