Re: AFS backup/restore using ADSM

[Russ Allbery]

Brian T Huntley <[EMAIL PROTECTED]> writes:

> Create a pts user with the IP address of the backup machine.  Then
> create a group (i.e 'backup') and make the IP address a member.

I recommend using a Kerberos identity rather than an IP address.  The
advantage is that while an IP address grants access to anyone who manages
to get any sort of access to that machine, the Kerberos identity requires
that they manage to read the srvtab, and in practice can limit the access
to root on that system.  Slightly more secure.

> Then set a write ACL in every dir, and tell users not to remove it.

Why write?  You only need read.  Do restores as a regular administrator;
most of the restores that users can do for themselves get caught by the
backup snapshots anyway.

-- 
Russ Allbery ([EMAIL PROTECTED])             <http://www.eyrie.org/~eagle/>