[Dirvish] Dirvish and sudo

Ben Luey lueyb at jilau1.colorado.edu
Thu Jun 30 14:49:12 PDT 2005


Setting up Dirvish with sudo turns out to be pretty straight-forward, and
below is a quick description of how to do it. I'd appreciate any comments
on this approach and its security, etc.

Thanks,

Ben


Add the following line into the master.conf on the backup machine:

rsync-client: "/usr/local/bin/rsync-new"

On the computer to be backed up, create the script
/usr/local/bin/rsync-new with content:

#!/bin/sh
sudo /usr/bin/rsync $*


Now when dirvish runs on the backup machine, it connects to the machine to
be backed-up up with ssh/rsync (as user dirvish is this example), but runs
"sudo rsync" instead of rsync on the remote machine.

Sudoers has to be setup on the machine to be backup-ed. One could just add
the line:

dirvish   ALL = NOPASSWD: /usr/bin/rsync

(assuming you log in as user dirvish). But then if a hacker broke in as
user dirvish, they could overwrite /etc/shadow with a simple rsync
command. I have the line:

dirvish   ALL = NOPASSWD: /usr/bin/rsync --server --sender -vlHogDtprx
--numeric-ids . $DIRECTORY_TO_BACKUP

which is much more restrictive and I think more secure. You need a line
for every vault that you are backing up. Also if your configuration of
dirvish is different, the options might be a little different.
Subsequently, if you change dirvish options, sudo might stop rejecting
dirvish's sudo rsync line. You can add the line:

echo $*>>/tmp/argument.txt

to rsync-new script to see what options dirvish is passing to rsync and
adjust /etc/sudoers accordingly. Maybe someone has clever way to restrict
rsync access to divish but give a little more flexibility in terms of
options passed, etc.


Ben













> Hi Ben, et al.
>
> I've been wanting to do that on one of the boxes here, however, I have
not
> had enough time to test it.  However, what I am doing is using SSH keys
and preventing root logins without a key.  I used the instructions found
here, for the most part: http://www.jdmz.net/ssh/
>
> Although it isn't a perfect solution, I would prefer sudo, it is a whole
bunch better than loosing the primary backup server and the whole farm.
>
> If you do get this working, please let us know, as I suspect this may be
one turn off's for may people wanting to use this backup package. I
especially was nervous about allowing root connections to my primary
server, even key'd ones.
>
> Thanks,
>
> James Clendenan
>
> Ben Luey said:
>> Has anyone setup dirvish with sudo? I'd like the dirvish backup server to
>> login to the main server as a non-root user, and execute commands as root
>> using sudo? What's the best way to have dirvish add the word "sudo" to
every remote command it executes?
>> Thanks,
>> Ben
>> --
>> Ben Luey
>> lueyb at jilau1.colorado.edu
>> _______________________________________________
>> Dirvish mailing list
>> Dirvish at dirvish.org
>> http://www.dirvish.org/mailman/listinfo/dirvish
>
>
> --------------------------------------
> Information Technology Officer 2005
> Queen's University Engineering Society
> E-mail: mangler at engsoc.queensu.ca
>
>
> _______________________________________________
> Dirvish mailing list
> Dirvish at dirvish.org
> http://www.dirvish.org/mailman/listinfo/dirvish
>


-- 
Ben Luey
lueyb at jilau1.colorado.edu





More information about the Dirvish mailing list