10

How can I enable the root account? I know it is not usually recommended but I'd like to setup a non-interactive script to backup my server using rsync. I could use --rsync-path="sudo rsync" but then I would need to store my sudo password in clear which seems much worse than enabling the root account.

3 Answers 3

10
  1. Create new, separate mybackup user accounts on the client and server
  2. Lock the passwords with sudo passwd -l mybackup for these accounts to prevent direct login
  3. Allow, via sudo, those new accounts to run a very specific /usr/bin/rsync/ --some-long-command /from/here /to/there command as root with NOPASSWD: in /etc/sudoers using sudo visudo
  4. Create new passwordless SSH keys for the local to the remote host using sudo -u mybackup ssh-keygen
  5. Add to sudo -u crontab -e on one or other end to run the remote rsync using ssh and the keys as the transport

This way the only command that can be run as root is the one that you have explicitly allowed, and the only remote user that can activate it is the holder of the other half of the installed ssh keypair, which because it also has the password locked can only be somebody with sudo access themselves, or the crontab you set up.

2
  • That's exactly what I didn't think of allowing a very specific command in sudoers (I allowed 'rsync'). Great suggestion! Jan 8, 2011 at 17:02
  • 2
    +1 for noting "a very specific ... command". Otherwise, giving a user the right to run sudo rsync and allowing the user to choose the options passed to rsync means that the user can use rsync to read/write the /etc/sudoers file for example, and grant himself full sudo access. Jun 5, 2013 at 20:38
7
  1. You can edit /etc/sudoers to allow whatever user is running the command (or all users) to run it as root without a password (perhaps a bit dangerous with rsync).

  2. Can't you just run the whole command/script/whatever as root? I assume this is going to run via cron so just add a root job via:

    sudo crontab -e
    

    Note: you can do fairly complex things by wrapping your cron command in a bash -e "..." brace or just do it in a separate script. Assuming it's not setuid'd, if root runs it (through cron), it will run as root so that should solve your permission issue.

3
  • The problem is that if I setup the script on my local machine and run it as root, it will have permission problems on the server. If I setup the script on my server and run it as root, than the local machine will be the one with permission problems. In other words, I need to have root privileges on both the local and server machines. Jan 7, 2011 at 0:34
  • You could write a script at each end and allow it to be run with sudo by normal users. That would be safer than just allowing rsync.
    – Oli
    Jan 7, 2011 at 10:48
  • Sudo is a great idea. You can specifiy precisely, which user can run which command. Do it.
    – Frank
    Jan 7, 2011 at 21:00
6

You could (but should not) give the root user a password with

sudo passwd root

Edit: Setuid bit does not work for scripts. Otherwise, you could use the setuid bit on the backup program.

sudo chown root backup
sudo chmod u+s backup

Maybe, you even want to run the backup as a cron job?

3
  • 1
    You don't need to specify "root" since sudo runs as the root's env its user is root. (sudo whoami returns, root) so just sudo passwd is needed. Jan 7, 2011 at 4:34
  • setuid doesn't work for scripts
    – enzotib
    Jan 7, 2011 at 8:53
  • Right, scripts are executed by the shell named in the she-bang line. Sorry for the misinformation.
    – Frank
    Jan 7, 2011 at 20:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .