BackupPC FAQ: Backing up the localhost (BackupPC server)

Why backup the local host using BackupPC?

If you have multiple disks, some reserved for BackupPC, then it makes sense to backup the remaining disks to BackupPC.

Even if you haven't installed dedicated disks for BackupPC's data, backing up the non-BackupPC parts of your file systems provides protection from inadvertently deleted data.

Back to Top

How do you setup the local host to backup?

The three issues are:

Daniel Poelzleithner suggests the alternative of using sudo, so there is no overhead with ssh. For example:

    $Conf{TarClientCmd} = '/usr/bin/sudo $tarPath -c -v -f - -C $shareName+ --totals';

Then run visudo to give BackupPC permission to run sudo without a password, but only be able to run the /bin/tar command. For example, add this line:

    backuppc ALL = NOPASSWD: /bin/tar

Note that an attacker who can become the backuppc user can then use sudo to run /bin/tar as root. Importantly, this means they can write files anywhere on the file system by doing tar -x. This allows them to become root.

If you want to be more cautious, you could create a short shell script (eg: tarCreate) that includes the create argument arguments from $Conf{TarClientCmd}, eg:

    #!/bin/sh -f
    exec /bin/tar -c $*

Make sure this script and all parent directories have no write permission. Then remove the -c from $Conf{TarClientCmd} and change the tar path:

    $Conf{TarClientCmd} = '/usr/bin/sudo /path/to/tarCreate -v -f - -C $shareName+ --totals';

Finally, run visudo to change the allowed command to /path/to/tarCreate.

In this case, a compromise of the backuppc user still allows the attacker to run tar -c. But this only allows them read access to files on the server, which they already have access to simply by inspecting the BackupPC backup data directories.

A similar setup with sudo can be used for rsync. See the SSH FAQ for more information.

Back to Top

SourceForge Logo
This page last modified 2007-10-21 19:29
© Copyright 2001-2005 Craig Barratt. BackupPC is hosted by SourceForge and distributed under a GPL license.