
Bacula 1.33 User's Guide
|
Chapter 17
|
|
 |
|
|
Bacula Security Issues
- The Clients (bacula-fd) must run as root to be able to access
all the system files.
- It is not necessary to run the Director as root.
- It is not necessary to run the Storage daemon as root, but you
must ensure that it can open the tape drives, which are often
restricted to root access by default.
- You should restrict access to the Bacula configuration files,
so that the passwords are not world-readable. The Bacula
daemons are password protected using CRAM-MD5 (i.e. the password is not
sent across the network). This will ensure that not everyone
can access the daemons. It is a reasonably good protection, but
can be cracked by experts.
- If you are using the recommended ports 9101, 9102, and 9103, you
will probably want to protect these ports from external access
using a firewall and/or using tcp wrappers (etc/hosts.allow).
- Currently all data that is sent across the network is unencrypted.
As a consequence, unless you use ssh or stunnel for
port forwarding, it is not recommended to do a backup across an
insecure network (e.g. the Internet). In a future version, we plan
to have ssl encryption built-in.
- You should ensure that the Bacula working directories are
readable and writable only by the Bacula daemons.
- If you are using MySQL it is not necessary for it to
run with root permission.
- The default Bacula grant-mysql-permissions script
grants all permissions to use the MySQL database without a
password. If you want security, please tighten this up!
- Don't forget that Bacula is a network program, so anyone anywhere
on the network with the console program and the Director's password
can access Bacula and the backed up data.
- You can restrict what IP addresses Bacula will bind to by using the
appropriate DirAddress, FDAddress, or SDAddress
records in the respective daemon configuration files.
TCP Wrappers
TCP Wrappers are implemented if
you turn them on when configuring (./configure --with-libwrap).
With this code enabled, you may control who may access your daemons.
This control is done by modifying the
file: /etc/hosts.allow. The program name that Bacula
uses when applying these access restrictions is the name you
specify in the daemon configuration file. You must not use
the twist option in your /etc/hosts.allow or it
will terminate the Bacula daemon when a connection is refused.
|