Take the 2-minute tour ×

I have a "backup" user on my server that needs to have read permissions everywhere. Doing chown 444 -R / backup doesn't seem like the right thing to do, so what should I do?

share|improve this question
add comment

6 Answers

up vote 3 down vote accepted

You're mixing two commands:

  • chown that is used to change the owner of a file. Exemple: chown root:adm /etc/passwd

  • chmod that is used to change the permission of a file. Exemple: chmod g+r myfile

Whatever your goal is, you really don't want to have your backup user to own every file and you certainly don't want to have every users on your system the right to read every files of your system.

What is your goal?

share|improve this answer
Exactly! I don't want the backup user to own every file, nor do I want every user to have read access everywhere. For some reason the others couldn't understand that. I understand the difference between chown and chmod. I just want the backup user to somehow be able to read every file so it can do its job. –  Jason Swett Oct 7 '10 at 13:12
Some files must not be readable by any other users than their owner (ssh private key for exemple). If you want to backup your system, you can either read the raw disk (but may have to restore the whole disk to get only 1 file) or do your backup as root. –  Benoit Oct 7 '10 at 13:23
If some files must not be readable by anyone other than their owners, how is backing up as root better than creating a user who has read permissions everywhere? Backing up as root seems to be a violation of the principle of least privilege, since the backup user doesn't need to write or execute anything, just read. –  Jason Swett Oct 7 '10 at 13:33
SSH for exemple doesn't work if you change the permission on the key files. That's why you must backup the keys as root (or their owner). –  Benoit Oct 7 '10 at 14:04
add comment

Under Linux, if you use an ACL capable filesystem (ext3, ReiserFS, ZFS will do I think), then you can set read and directory traversal right to your backup operator user.

Let's say you want to backup /home

  1. Your partition should be mounted with the "acl" option (you can do that with mount -o remount,acl /home )
  2. Install acl tools (setfacl and getfacl)
  3. setfacl -R -m u:"Backup User":rx /home

If you want to ensure that new files and directories will have proper rights too, the set the default ACL :

  1. setfacl -R -m d:u:"Backup User":rx /home

You can obviously do that with a finer grain (for instance if you don't want to backup gnupg or ssh keys, - which should be protected by a password anyway)

Performing a backup as root is not wise, IMHO. First if you inadvertently run out of disk space, you can consume up to the last available block, and render your system unstable. Second, if you are not completely sure of the script or command you use for backup, a malicious user could make your backup go recursive, or do nasty things as root.

I personally use a rsync mechanism for syncing a server on a replica. I use simple group rights on most of the sync points, except for the home where I use ACLs

share|improve this answer
add comment

The right way to do this is not by changing your file permissions. You should use sudo and/or setuid executables.

share|improve this answer
All the operations performed by my backup user are pre-canned, so I don't have the option of using sudo. –  Jason Swett Oct 7 '10 at 13:30
What is your backup software? –  Coops Sep 8 '11 at 10:11
@Coops: You need to use "@" to address the user you're trying to communicate with if they're not the owner of the answer (or question) your comment is attached to. For example: "@Jason" –  Dennis Williamson Sep 8 '11 at 17:44
add comment

chmod g+r myfile

g represents the group of the file (administrators).

r represents the read permission.

  • represents the fact that the permission is added.
share|improve this answer
add comment

chmod 0444 /file. for simplicity, use this: http://permissions-calculator.org/

share|improve this answer
add comment

The simple answer is to run the backup as root. In fact, short of doing very onerous and/or dangerous things, that is the only answer as far as I can tell.

If you were to you can't set backup as the owner of everthing, nor can you set it as the group for everthing, so the only other way to give it access is to give everyone access. Simply put, you run backups are root or make a mess of your system.

It is totally normal to back up as root.


share|improve this answer
add comment

Your Answer


