How can I enable the root account? I know it is not usually recommended but I'd like to setup a non-interactive script to backup my server using rsync. I could use --rsync-path="sudo rsync"
but then I would need to store my sudo password in clear which seems much worse than enabling the root account.
3 Answers
- Create new, separate
mybackup
user accounts on the client and server - Lock the passwords with
sudo passwd -l mybackup
for these accounts to prevent direct login - Allow, via
sudo
, those new accounts to run a very specific/usr/bin/rsync/ --some-long-command /from/here /to/there
command as root withNOPASSWD:
in/etc/sudoers
usingsudo visudo
- Create new passwordless SSH keys for the local to the remote host using
sudo -u mybackup ssh-keygen
- Add to
sudo -u crontab -e
on one or other end to run the remotersync
usingssh
and the keys as the transport
This way the only command that can be run as root is the one that you have explicitly allowed, and the only remote user that can activate it is the holder of the other half of the installed ssh keypair, which because it also has the password locked can only be somebody with sudo access themselves, or the crontab you set up.
-
That's exactly what I didn't think of allowing a very specific command in sudoers (I allowed 'rsync'). Great suggestion! Jan 8, 2011 at 17:02
-
2+1 for noting "a very specific ... command". Otherwise, giving a user the right to run
sudo rsync
and allowing the user to choose the options passed to rsync means that the user can use rsync to read/write the/etc/sudoers
file for example, and grant himself full sudo access. Jun 5, 2013 at 20:38
You can edit
/etc/sudoers
to allow whatever user is running the command (or all users) to run it asroot
without a password (perhaps a bit dangerous with rsync).Can't you just run the whole command/script/whatever as
root
? I assume this is going to run via cron so just add aroot
job via:sudo crontab -e
Note: you can do fairly complex things by wrapping your cron command in a
bash -e "..."
brace or just do it in a separate script. Assuming it's not setuid'd, ifroot
runs it (throughcron
), it will run asroot
so that should solve your permission issue.
-
The problem is that if I setup the script on my local machine and run it as root, it will have permission problems on the server. If I setup the script on my server and run it as root, than the local machine will be the one with permission problems. In other words, I need to have root privileges on both the local and server machines. Jan 7, 2011 at 0:34
-
You could write a script at each end and allow it to be run with
sudo
by normal users. That would be safer than just allowingrsync
.– Oli ♦Jan 7, 2011 at 10:48 -
Sudo is a great idea. You can specifiy precisely, which user can run which command. Do it.– FrankJan 7, 2011 at 21:00
You could (but should not) give the root user a password with
sudo passwd root
Edit: Setuid bit does not work for scripts. Otherwise, you could use the setuid bit on the backup program.
sudo chown root backup
sudo chmod u+s backup
Maybe, you even want to run the backup as a cron job?
-
1You don't need to specify "root" since sudo runs as the root's env its user is root. (
sudo whoami
returns, root) so justsudo passwd
is needed. Jan 7, 2011 at 4:34 -
-
Right, scripts are executed by the shell named in the she-bang line. Sorry for the misinformation.– FrankJan 7, 2011 at 20:57