[2626] in SIPB-AFS-requests
Re: REQ: new volume for (non afs) backup info
daemon@ATHENA.MIT.EDU (mhpower@MIT.EDU)
Sat Feb 1 23:06:50 1997
From: mhpower@MIT.EDU
To: sit@MIT.EDU
Cc: sipb-afsreq@MIT.EDU
In-Reply-To: "[2625] in SIPB-AFS-requests"
Date: Sat, 01 Feb 1997 23:06:35 EST
>Rationale: foley and I are planning on storing backup software and
>related stuff in AFS (as opposed to per machine) ...
Could you explain more about this? For example, is the idea that any
program that's currently run from the /usr/local/backup/bin directory
on the local disk would instead be run from some directory in AFS?
Also, would the processes running these programs run aklog before
accessing that AFS directory, or would they instead run without tokens
and rely on that directory being readable by system:anyuser?
My opinion is that, in general, there shouldn't be any (semi)-regular
root processes on server machines that run programs out of AFS without
authentication. This is a security risk in that an attacker can spoof
the response from the AFS fileserver and thereby get the machine to
execute arbitrary programs as root. As far as I know, the backup
processes have to run as root locally (obviously they couldn't
otherwise backup files regardless of permissions). Although there may
be some programs run as root from AFS on all of the server machines,
the people setting up the other services on the machines have often
gone to a lot of trouble to have as many programs as possible run from
local disk, and some services are in the process of being changed to
run their programs entirely from local disk.
If the backup processes can run with tokens, that would probably be
ok, although I think the maximum ticket lifetime is close enough to
the duration of some backups that it might be hard to get this working
reliably. (I think it depends on whether any new program might be
started after 21.25 hours without another opportunity to get tokens).
Matt
