Hi Team,
I observed following while my test cases please clarify my doubts,
THE NETWORK BACKUP AGENT IS running as a root user in Lunux Machines ,
can we change & run it as a non root user with out sudo access. is any possibility to run it as not root user.
asked 2016-12-19 11:34:55 -0500
This post is a wiki. Anyone with karma >75 is welcome to improve it.
Hi,
Please be informed that Vembu Network Backup Linux Agent should be run with user who has sudo ( administrator ) privilege. Hence please make sure that Network Backup Agent is running with any one of the administrator account in your machine.
We have a concern here: This mandates that even on production servers the vembu backup agent process needs to run 24x7 as root; Isn't the privilege needed by agent process for its role is only read privilege on the files/directories being backup up? So in env where security is critical, Administrators follow the "principle of least privilege" and would want the agent to run as user that has just read permissions on the files and not as root; As you can understand, the agent running as root is a security vulnerability. Example of a potential risk: a malicious program exploiting this and getting other files out of the host via the agent since root has permission to read any file on the server. This is just one example and there could be many potential exploitations of this vulnerability. So can the POC from Vembu please let us know ...
Hi Narsihma, Currently we are running apache services in Jailed environment, which needs admin privilege to start or stop those services. This is the main reason we need root privilege to run our services. We are analyzing the possibilities to run the entire solution in a non admin user and we will update you soon once we implement it in our product. We will keep you update the status in this thread regarding the progress.
jameer ( 2016-12-27 09:03:26 -0500 )editJameer, Regarding the Vembu backup agent process (VembuNetworkBackup that listens on port 31005) running as root, it doesn't have any chroot privilege dependency right? So with the current product code, could you let us know if and what is the way to run this agent process as non root user (while apache runs as root)
Phani ( 2016-12-30 10:56:49 -0500 )editHi Phani, Like we posted earlier in this thread we are currently analyzing the possibilities to run the entire solution in a non root user. Once we come up the solution we will update it in this thread. For your information Vembu NetworkBackup agent need chroot privileges to run the webservices. We haven't tested the Vembu NetworkBackup by running the apache in root user and run the Vembu NetworkBackup agent in non root user. Hence we request you to wait until we finalize the steps to run Vembu NetworkBackup agent in non root user.
jameer ( 2016-12-30 11:38:56 -0500 )editwe can't run it as a non sudo user
at the time of installation we provide sudo access to the user after we remove the sudo access is the agent will run
thanks for the response. We have a concern here: This mandates that even on production servers the vembu backup agent process needs to run 24x7 as root; Isn't the privilege needed by agent process for its role is only read privilege on the files/directories being backup up? So in env where security is critical, Administrators follow the "principle of least privilege" and would want the agent to run as user that has just read permissions on the files and not as root; As you can understand, the agent running as root is a security vulnerability. Example of a potential risk: a malicious program exploiting this and getting other files out of the host via the agent since root has permission to read any file on the server. This is just one example and there could be many potential exploitations of this vulnerability. So please let us know the ...
Jameer, 1) Any updates on this. ? 2) I had looked at the code of the Vembu agent script startVembuNetworkBackup.sh and realised that passing it nonrootusername as command line parameter cause the agent process to run as that non-root user; We even tested it by starting up the agent giving nonroot user as param and ran backups etc. All were successful. Can you comment if we can use this method. -Phani Arega
Hi Phani,
We have this option ( "sh startVembuNetworkBackup.sh <username>" ) in the startup script in order to run the Vembu NetworkBackup agent in a specific user account (admin users). In addition, you should have the root privilege to run this script.
Regarding non-admin user account, we have not yet fully tested this case in our test environment. But however, if this option working in your environment, kindly go ahead and let us know, if you face any issues in that. We will also cover all the cases related to running application in non-admin user account and update the status in this forum thread.
Thanks for the comments Jameer.
As known, the privileges functionally needed by the agent are only read privilege on the files/folders being backedup and write permission on Vembu's housekeeping data folders. So mandating the agent to be run as admin(super) user is violation of the cardinal security "Principle of least Privilege" (https://en.wikipedia.org/wiki/Principleofleast_privilege) . Running agent as root is a security vulnerability. Example of a potential risk: a malicious program/hacker exploiting this and getting other files out of the host via the agent since superuser has permission to read any file on the server. This is just one example and there could be many potential exploitations of this vulnerability. Moreover, Vembu backup works as a pull model. i.e. backup schedule is maintained on the external backup server & for backup, program running on backup server contacts the agent running on the database server and pulls the data via the agent. Consequently the agent needs to be up and listening 24x7 since it doesn't know when all the backup server machine program will request for data. For production envs, running 24x7 aggravates the security vulnerability of the agent running as root.
It is more than an year since we brought up this legitimate concern. We would appreciate if Vembu can expedite the testing and certification of scenario of running the Vembu backup agent as non-admin account. We are using Ubuntu Linux 14.04; This would further enhance customer satisfaction & security compliance of your good product.
Hi Phani,
Thanks for your details. As we said, currently we are testing the Linux Vembu NetworkBackup builds using non-admin user accounts. We will update our results ASAP.
Meanwhile, please note that Vembu NetworkBackup won't work as 'pull' model. All the backup configurations (including scheduling details) will be stored in agent's internal database and once the schedule time reached, the agent will read the data (modified bytes in case of incremental) which is configured for backup and then send the data to the VembuBDR backup server and the data will be compressed & encrypted during the data transfer. Since its working in Push method, you can restrict the inbound connections to the particular machine (since there won't be any communications from the external systems required) to make it secure.
Hi Phani,
We have tested the basic functionalities by running the Vembu NetworkBackup client application under the non-root user account and all the basic backup & recovery cases are working fine as expected. Hence you can run the Vembu NetworkBackup client under any non-root user.
However, after automatic software update, the installer will start the application as a root user as per the design. In this case, you have to stop the Vembu NetworkBackup client application and start it under non-root user account after software upgrade or you should disable automatic software update and do manual upgrade whenever we release new updates.
Connect with us
Copyright © Vembu Technologies 2022. All Rights Reserved.
