[Bacula-users] Problem backing up catalog
Hello, I'm having a very hard time backing up the catalog, after I've moved the backup server to another server...it keeps giving me this error: 23-Oct 11:26 behemot-dir JobId 225: BeforeJob: run command "/usr/libexec/ bacula/make_catalog_backup bacula bacula" 23-Oct 11:26 behemot-dir JobId 225: BeforeJob: mysqldump: Got error: 1045: Access denied for user 'bacula'@'localhost' (using password: NO) when trying to connect 23-Oct 11:26 behemot-dir JobId 225: Error: Runscript: BeforeJob returned non-zero status=2. ERR=Child exited with code 2 But on the bacula-dir.conf file, I do have setted up the bacula password on the Catalog configuration, so why is he not even trying to use it? The other backups run absolutly normal. Thanks Mateus - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
Mateus Interciso wrote: > But on the bacula-dir.conf file, I do have setted up the bacula password > on the Catalog configuration, so why is he not even trying to use it? > The other backups run absolutly normal. You are running make_catalog_backup with the wrong arguments. This is configured via the RunBeforeJob line, not the catalog resource. From 'make_catalog_backup' (which is a shell script). # $1 is the name of the database to be backed up and the name # of the output file (default = bacula). # $2 is the user name with which to access the database # (default = bacula). # $3 is the password with which to access the database or "" if no password # (default "") So you need a third argument which is the db password. Modify the RunBeforeJob = "make_catalog_backup bacula bacula" to read to read RunBeforeJob = "make_catalog_backup bacula bacula " - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
On Tue, 23 Oct 2007 14:44:15 +0100, Chris Howells wrote: > Mateus Interciso wrote: >> But on the bacula-dir.conf file, I do have setted up the bacula >> password on the Catalog configuration, so why is he not even trying to >> use it? The other backups run absolutly normal. > > You are running make_catalog_backup with the wrong arguments. This is > configured via the RunBeforeJob line, not the catalog resource. > > From 'make_catalog_backup' (which is a shell script). > > # $1 is the name of the database to be backed up and the name # of > the output file (default = bacula). # $2 is the user name with which to > access the database # (default = bacula). > # $3 is the password with which to access the database or "" if no > password # (default "") > > > So you need a third argument which is the db password. Modify the > > RunBeforeJob = "make_catalog_backup bacula bacula" to read > > to read > > RunBeforeJob = "make_catalog_backup bacula bacula " > > - > This SF.net email is sponsored by: Splunk Inc. Still grepping through > log files to find problems? Stop. Now Search log events and > configuration files using AJAX and a browser. Download your FREE copy of > Splunk now >> http://get.splunk.com/ Now it worked, thanks :D I just wonder why it was working before, since the configuration files are exactly the same, and the env is the same as well - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
On Tuesday 23 October 2007 14:52:21 Mateus Interciso wrote: > On Tue, 23 Oct 2007 14:44:15 +0100, Chris Howells wrote: > > Mateus Interciso wrote: > >> But on the bacula-dir.conf file, I do have setted up the bacula > >> password on the Catalog configuration, so why is he not even trying to > >> use it? The other backups run absolutly normal. > > > > You are running make_catalog_backup with the wrong arguments. This is > > configured via the RunBeforeJob line, not the catalog resource. > > > > From 'make_catalog_backup' (which is a shell script). > > > > # $1 is the name of the database to be backed up and the name # of > > the output file (default = bacula). # $2 is the user name with which to > > access the database # (default = bacula). > > # $3 is the password with which to access the database or "" if no > > password # (default "") > > > > > > So you need a third argument which is the db password. Modify the > > > > RunBeforeJob = "make_catalog_backup bacula bacula" to read > > > > to read > > > > RunBeforeJob = "make_catalog_backup bacula bacula " > > - > > Now it worked, thanks :D > I just wonder why it was working before, since the configuration files > are exactly the same, and the env is the same as well On this matter; adding the password to the RunBeforeJob line causes my database password to appear on the status emails: 24-Oct 13:09 fs01-dir: BeforeJob: run command "/etc/bacula/make_catalog_backup bacula bacula MyPasswordHere" Status emails are sent in clear text across our network. Is there a recommended solution to include sensitive variables in the config files without exposing them like this? Regards, Simon Barrett - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
On 24 Oct 2007 at 14:39, Simon Barrett wrote: > On Tuesday 23 October 2007 14:52:21 Mateus Interciso wrote: > > On Tue, 23 Oct 2007 14:44:15 +0100, Chris Howells wrote: > > > Mateus Interciso wrote: > > >> But on the bacula-dir.conf file, I do have setted up the bacula > > >> password on the Catalog configuration, so why is he not even trying to > > >> use it? The other backups run absolutly normal. > > > > > > You are running make_catalog_backup with the wrong arguments. This is > > > configured via the RunBeforeJob line, not the catalog resource. > > > > > > From 'make_catalog_backup' (which is a shell script). > > > > > > # $1 is the name of the database to be backed up and the name # of > > > the output file (default = bacula). # $2 is the user name with which to > > > access the database # (default = bacula). > > > # $3 is the password with which to access the database or "" if no > > > password # (default "") > > > > > > > > > So you need a third argument which is the db password. Modify the > > > > > > RunBeforeJob = "make_catalog_backup bacula bacula" to read > > > > > > to read > > > > > > RunBeforeJob = "make_catalog_backup bacula bacula " > > > > - > > > > Now it worked, thanks :D > > I just wonder why it was working before, since the configuration files > > are exactly the same, and the env is the same as well > > > On this matter; adding the password to the RunBeforeJob line causes my > database password to appear on the status emails: > > 24-Oct 13:09 fs01-dir: BeforeJob: run command > "/etc/bacula/make_catalog_backup > bacula bacula MyPasswordHere" > > Status emails are sent in clear text across our network. Is there a > recommended solution to include sensitive variables in the config files > without exposing them like this? http://www.bacula.org/dev-manual/Catalog_Maintenance.html Click on Security considerations -- Dan Langille - http://www.langille.org/ Available for hire: http://www.freebsddiary.org/dan_langille.php - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
In the message dated: Wed, 24 Oct 2007 14:39:00 BST,
The pithy ruminations from Simon Barrett on
were:
=> On Tuesday 23 October 2007 14:52:21 Mateus Interciso wrote:
=> > On Tue, 23 Oct 2007 14:44:15 +0100, Chris Howells wrote:
=> > > Mateus Interciso wrote:
[SNIP!]
=>
=>
=> On this matter; adding the password to the RunBeforeJob line causes my
=> database password to appear on the status emails:
=>
=> 24-Oct 13:09 fs01-dir: BeforeJob: run command
"/etc/bacula/make_catalog_backup
=> bacula bacula MyPasswordHere"
=>
=> Status emails are sent in clear text across our network. Is there a
=> recommended solution to include sensitive variables in the config files
=> without exposing them like this?
Sure. Here's one easy solution:
In $BACULA/bacula-dir.conf, have the catalog backup job call a wrapper
script instead of calling make_catalog_backup directly, as in:
=== bacula-dir.conf snippet ===
# Backup the catalog database (after the nightly save)
Job {
Name = "BackupCatalog"
Type = Backup
Level = Full
Messages = Standard
Priority = 10
Storage = pv132t
Prefer Mounted Volumes = yes
Maximum Concurrent Jobs = 1
Pool = Incremental
Incremental Backup Pool = Incremental
SpoolData = yes
Client = parthenon-fd
FileSet="Catalog"
Schedule = "AfterBackup"
RunBeforeJob = "/usr/local/bacula/bin/make_catalog_backup.wrapper"
RunAfterJob = "/usr/local/bacula/bin/run_after_catalog_backup"
Write Bootstrap = "/usr/local/bacula/var/working/BackupCatalog.bsr"
Priority = 11 # run after main backup
}
===
The wrapper script is something like:
=== make_catalog_backup.wrapper ===
#! /bin/sh
exec /usr/local/bacula/bin/make_catalog_backup bacula bacula $PASSWORD
===
This will prevent mail from bacula from including the database password. The
advantage to this method is that it doesn't change make_catalog_backup, so that
future bacula upgrades will be transparent.
The good news is that mysql is security-conscious enough to overwrite the
command line parameter for the password, so a "ps" display doesn't show the
password as part of the mysql command.
Unfortunately, make_catalog_backup is not that smart, and a "ps" (or grepping
through /proc) will show the password on the command-line. If the backup server
is a single user machine that you consider secure, this may not represent too
much of a risk.
On the other hand, if you want to eliminate this problem completely, skip
the wrapper script and modify make_catalog_backup so that it uses hard-coded
values from within the script instead of command-line parameters for the
dbname, the dbuser, and the password.
=>
=> Regards,
=>
=> Simon Barrett
=>
Mark Bergman [EMAIL PROTECTED]
System Administrator
Section of Biomedical Image Analysis 215-662-7310
Department of Radiology, University of Pennsylvania
http://pgpkeys.pca.dfn.de:11371/pks/lookup?search=mark.bergman%40.uphs.upenn.edu
-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
___
Bacula-users mailing list
Bacula-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
On 2007.10.24. 16:53, Dan Langille wrote:
> On 24 Oct 2007 at 14:39, Simon Barrett wrote:
...
>> On this matter; adding the password to the RunBeforeJob line causes my
>> database password to appear on the status emails:
>>
>> 24-Oct 13:09 fs01-dir: BeforeJob: run command
>> "/etc/bacula/make_catalog_backup
>> bacula bacula MyPasswordHere"
>>
>> Status emails are sent in clear text across our network. Is there a
>> recommended solution to include sensitive variables in the config files
>> without exposing them like this?
>
> http://www.bacula.org/dev-manual/Catalog_Maintenance.html
>
> Click on Security considerations
using bacula 2.2.5, there seems to be several problems with these
suggestions.
one (when not running director as root) i am outlining in another email,
"problems when not running director as root".
another one is that even if i hardcode password in the
make_catalog_backup scripts, something prints the password to messages,
if python scripting is enabled.
the line looks a bit weird, as it contains what seems to be another line
at the end.
30-Oct 11:40 backup_1-dir JobId 52: ('bacula', None, 'bacula',
'baculapassword', None, 0, 'MySQL')30-Oct 11:40 backup_1-dir JobId 52:
python script is slightly modified default example, and looking over it,
i can't see any report line which could output anything like that.
what could be the reason for this line ?
--
Rich
-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
___
Bacula-users mailing list
Bacula-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
Hi,
30.10.2007 10:54,, Rich wrote::
> On 2007.10.24. 16:53, Dan Langille wrote:
>> On 24 Oct 2007 at 14:39, Simon Barrett wrote:
> ...
>>> On this matter; adding the password to the RunBeforeJob line causes my
>>> database password to appear on the status emails:
>>>
>>> 24-Oct 13:09 fs01-dir: BeforeJob: run command
>>> "/etc/bacula/make_catalog_backup
>>> bacula bacula MyPasswordHere"
>>>
>>> Status emails are sent in clear text across our network. Is there a
>>> recommended solution to include sensitive variables in the config files
>>> without exposing them like this?
>> http://www.bacula.org/dev-manual/Catalog_Maintenance.html
>>
>> Click on Security considerations
>
> using bacula 2.2.5, there seems to be several problems with these
> suggestions.
>
> one (when not running director as root) i am outlining in another email,
> "problems when not running director as root".
> another one is that even if i hardcode password in the
> make_catalog_backup scripts, something prints the password to messages,
> if python scripting is enabled.
>
> the line looks a bit weird, as it contains what seems to be another line
> at the end.
>
> 30-Oct 11:40 backup_1-dir JobId 52: ('bacula', None, 'bacula',
> 'baculapassword', None, 0, 'MySQL')30-Oct 11:40 backup_1-dir JobId 52:
>
> python script is slightly modified default example, and looking over it,
> i can't see any report line which could output anything like that.
The above looks like a printout of the CatalogRes provided as an
attribute by Baculas job object.
Arno
> what could be the reason for this line ?
--
Arno Lehmann
IT-Service Lehmann
www.its-lehmann.de
-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
___
Bacula-users mailing list
Bacula-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
On 2007.10.30. 12:05, Arno Lehmann wrote:
...
>> the line looks a bit weird, as it contains what seems to be another line
>> at the end.
>>
>> 30-Oct 11:40 backup_1-dir JobId 52: ('bacula', None, 'bacula',
>> 'baculapassword', None, 0, 'MySQL')30-Oct 11:40 backup_1-dir JobId 52:
>>
>> python script is slightly modified default example, and looking over it,
>> i can't see any report line which could output anything like that.
>
> The above looks like a printout of the CatalogRes provided as an
> attribute by Baculas job object.
ah, indeed - i was looking for report lines, missed print lines...
print job.CatalogRes
seems that default example script suffers from some problems :)
> Arno
>
>> what could be the reason for this line ?
--
Rich
-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
___
Bacula-users mailing list
Bacula-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bacula-users
