Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

How can I enable the root account? I know it is not usually recommended but I'd like to setup a non-interactive script to backup my server using rsync. I could use --rsync-path="sudo rsync" but then I would need to store my sudo password in clear which seems much worse than enabling the root account.

share|improve this question

3 Answers 3

up vote 8 down vote accepted
  1. Create new, separate mybackup user accounts on the client and server
  2. Lock the passwords with sudo passwd -l mybackup for these accounts to prevent direct login
  3. Allow, via sudo, those new accounts to run a very specific /usr/bin/rsync/ --some-long-command /from/here /to/there command as root with NOPASSWD: in /etc/sudoers using sudo visudo
  4. Create new passwordless SSH keys for the local to the remote host using sudo -u mybackup ssh-keygen
  5. Add to sudo -u crontab -e on one or other end to run the remote rsync using ssh and the keys as the transport

This way the only command that can be run as root is the one that you have explicitly allowed, and the only remote user that can activate it is the holder of the other half of the installed ssh keypair, which because it also has the password locked can only be somebody with sudo access themselves, or the crontab you set up.

share|improve this answer
    
That's exactly what I didn't think of allowing a very specific command in sudoers (I allowed 'rsync'). Great suggestion! –  Olivier Lalonde Jan 8 '11 at 17:02
    
+1 for noting "a very specific ... command". Otherwise, giving a user the right to run sudo rsync and allowing the user to choose the options passed to rsync means that the user can use rsync to read/write the /etc/sudoers file for example, and grant himself full sudo access. –  Georges Dupéron Jun 5 '13 at 20:38
  1. You can edit /etc/sudoers to allow whatever user is running the command (or all users) to run it as root without a password (perhaps a bit dangerous with rsync).

  2. Can't you just run the whole command/script/whatever as root? I assume this is going to run via cron so just add a root job via:

    sudo crontab -e
    

    Note: you can do fairly complex things by wrapping your cron command in a bash -e "..." brace or just do it in a separate script. Assuming it's not setuid'd, if root runs it (through cron), it will run as root so that should solve your permission issue.

share|improve this answer
    
The problem is that if I setup the script on my local machine and run it as root, it will have permission problems on the server. If I setup the script on my server and run it as root, than the local machine will be the one with permission problems. In other words, I need to have root privileges on both the local and server machines. –  Olivier Lalonde Jan 7 '11 at 0:34
    
You could write a script at each end and allow it to be run with sudo by normal users. That would be safer than just allowing rsync. –  Oli Jan 7 '11 at 10:48
    
Sudo is a great idea. You can specifiy precisely, which user can run which command. Do it. –  Frank Jan 7 '11 at 21:00

You could (but should not) give the root user a password with

sudo passwd root

Edit: Setuid bit does not work for scripts. Otherwise, you could use the setuid bit on the backup program.

sudo chown root backup
sudo chmod u+s backup

Maybe, you even want to run the backup as a cron job?

share|improve this answer
    
You don't need to specify "root" since sudo runs as the root's env its user is root. (sudo whoami returns, root) so just sudo passwd is needed. –  Marco Ceppi Jan 7 '11 at 4:34
    
setuid doesn't work for scripts –  enzotib Jan 7 '11 at 8:53
    
Right, scripts are executed by the shell named in the she-bang line. Sorry for the misinformation. –  Frank Jan 7 '11 at 20:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.