[Bacula-users] Problem backing up catalog
Hello, I'm having a very hard time backing up the catalog, after I've moved the backup server to another server...it keeps giving me this error: 23-Oct 11:26 behemot-dir JobId 225: BeforeJob: run command "/usr/libexec/ bacula/make_catalog_backup bacula bacula" 23-Oct 11:26 behemot-dir JobId 225: BeforeJob: mysqldump: Got error: 1045: Access denied for user 'bacula'@'localhost' (using password: NO) when trying to connect 23-Oct 11:26 behemot-dir JobId 225: Error: Runscript: BeforeJob returned non-zero status=2. ERR=Child exited with code 2 But on the bacula-dir.conf file, I do have setted up the bacula password on the Catalog configuration, so why is he not even trying to use it? The other backups run absolutly normal. Thanks Mateus - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
Mateus Interciso wrote: > But on the bacula-dir.conf file, I do have setted up the bacula password > on the Catalog configuration, so why is he not even trying to use it? > The other backups run absolutly normal. You are running make_catalog_backup with the wrong arguments. This is configured via the RunBeforeJob line, not the catalog resource. From 'make_catalog_backup' (which is a shell script). # $1 is the name of the database to be backed up and the name # of the output file (default = bacula). # $2 is the user name with which to access the database # (default = bacula). # $3 is the password with which to access the database or "" if no password # (default "") So you need a third argument which is the db password. Modify the RunBeforeJob = "make_catalog_backup bacula bacula" to read to read RunBeforeJob = "make_catalog_backup bacula bacula " - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
On Tue, 23 Oct 2007 14:44:15 +0100, Chris Howells wrote: > Mateus Interciso wrote: >> But on the bacula-dir.conf file, I do have setted up the bacula >> password on the Catalog configuration, so why is he not even trying to >> use it? The other backups run absolutly normal. > > You are running make_catalog_backup with the wrong arguments. This is > configured via the RunBeforeJob line, not the catalog resource. > > From 'make_catalog_backup' (which is a shell script). > > # $1 is the name of the database to be backed up and the name # of > the output file (default = bacula). # $2 is the user name with which to > access the database # (default = bacula). > # $3 is the password with which to access the database or "" if no > password # (default "") > > > So you need a third argument which is the db password. Modify the > > RunBeforeJob = "make_catalog_backup bacula bacula" to read > > to read > > RunBeforeJob = "make_catalog_backup bacula bacula " > > - > This SF.net email is sponsored by: Splunk Inc. Still grepping through > log files to find problems? Stop. Now Search log events and > configuration files using AJAX and a browser. Download your FREE copy of > Splunk now >> http://get.splunk.com/ Now it worked, thanks :D I just wonder why it was working before, since the configuration files are exactly the same, and the env is the same as well - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
On Tuesday 23 October 2007 14:52:21 Mateus Interciso wrote: > On Tue, 23 Oct 2007 14:44:15 +0100, Chris Howells wrote: > > Mateus Interciso wrote: > >> But on the bacula-dir.conf file, I do have setted up the bacula > >> password on the Catalog configuration, so why is he not even trying to > >> use it? The other backups run absolutly normal. > > > > You are running make_catalog_backup with the wrong arguments. This is > > configured via the RunBeforeJob line, not the catalog resource. > > > > From 'make_catalog_backup' (which is a shell script). > > > > # $1 is the name of the database to be backed up and the name # of > > the output file (default = bacula). # $2 is the user name with which to > > access the database # (default = bacula). > > # $3 is the password with which to access the database or "" if no > > password # (default "") > > > > > > So you need a third argument which is the db password. Modify the > > > > RunBeforeJob = "make_catalog_backup bacula bacula" to read > > > > to read > > > > RunBeforeJob = "make_catalog_backup bacula bacula " > > - > > Now it worked, thanks :D > I just wonder why it was working before, since the configuration files > are exactly the same, and the env is the same as well On this matter; adding the password to the RunBeforeJob line causes my database password to appear on the status emails: 24-Oct 13:09 fs01-dir: BeforeJob: run command "/etc/bacula/make_catalog_backup bacula bacula MyPasswordHere" Status emails are sent in clear text across our network. Is there a recommended solution to include sensitive variables in the config files without exposing them like this? Regards, Simon Barrett - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
On 24 Oct 2007 at 14:39, Simon Barrett wrote: > On Tuesday 23 October 2007 14:52:21 Mateus Interciso wrote: > > On Tue, 23 Oct 2007 14:44:15 +0100, Chris Howells wrote: > > > Mateus Interciso wrote: > > >> But on the bacula-dir.conf file, I do have setted up the bacula > > >> password on the Catalog configuration, so why is he not even trying to > > >> use it? The other backups run absolutly normal. > > > > > > You are running make_catalog_backup with the wrong arguments. This is > > > configured via the RunBeforeJob line, not the catalog resource. > > > > > > From 'make_catalog_backup' (which is a shell script). > > > > > > # $1 is the name of the database to be backed up and the name # of > > > the output file (default = bacula). # $2 is the user name with which to > > > access the database # (default = bacula). > > > # $3 is the password with which to access the database or "" if no > > > password # (default "") > > > > > > > > > So you need a third argument which is the db password. Modify the > > > > > > RunBeforeJob = "make_catalog_backup bacula bacula" to read > > > > > > to read > > > > > > RunBeforeJob = "make_catalog_backup bacula bacula " > > > > - > > > > Now it worked, thanks :D > > I just wonder why it was working before, since the configuration files > > are exactly the same, and the env is the same as well > > > On this matter; adding the password to the RunBeforeJob line causes my > database password to appear on the status emails: > > 24-Oct 13:09 fs01-dir: BeforeJob: run command > "/etc/bacula/make_catalog_backup > bacula bacula MyPasswordHere" > > Status emails are sent in clear text across our network. Is there a > recommended solution to include sensitive variables in the config files > without exposing them like this? http://www.bacula.org/dev-manual/Catalog_Maintenance.html Click on Security considerations -- Dan Langille - http://www.langille.org/ Available for hire: http://www.freebsddiary.org/dan_langille.php - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
In the message dated: Wed, 24 Oct 2007 14:39:00 BST, The pithy ruminations from Simon Barrett on were: => On Tuesday 23 October 2007 14:52:21 Mateus Interciso wrote: => > On Tue, 23 Oct 2007 14:44:15 +0100, Chris Howells wrote: => > > Mateus Interciso wrote: [SNIP!] => => => On this matter; adding the password to the RunBeforeJob line causes my => database password to appear on the status emails: => => 24-Oct 13:09 fs01-dir: BeforeJob: run command "/etc/bacula/make_catalog_backup => bacula bacula MyPasswordHere" => => Status emails are sent in clear text across our network. Is there a => recommended solution to include sensitive variables in the config files => without exposing them like this? Sure. Here's one easy solution: In $BACULA/bacula-dir.conf, have the catalog backup job call a wrapper script instead of calling make_catalog_backup directly, as in: === bacula-dir.conf snippet === # Backup the catalog database (after the nightly save) Job { Name = "BackupCatalog" Type = Backup Level = Full Messages = Standard Priority = 10 Storage = pv132t Prefer Mounted Volumes = yes Maximum Concurrent Jobs = 1 Pool = Incremental Incremental Backup Pool = Incremental SpoolData = yes Client = parthenon-fd FileSet="Catalog" Schedule = "AfterBackup" RunBeforeJob = "/usr/local/bacula/bin/make_catalog_backup.wrapper" RunAfterJob = "/usr/local/bacula/bin/run_after_catalog_backup" Write Bootstrap = "/usr/local/bacula/var/working/BackupCatalog.bsr" Priority = 11 # run after main backup } === The wrapper script is something like: === make_catalog_backup.wrapper === #! /bin/sh exec /usr/local/bacula/bin/make_catalog_backup bacula bacula $PASSWORD === This will prevent mail from bacula from including the database password. The advantage to this method is that it doesn't change make_catalog_backup, so that future bacula upgrades will be transparent. The good news is that mysql is security-conscious enough to overwrite the command line parameter for the password, so a "ps" display doesn't show the password as part of the mysql command. Unfortunately, make_catalog_backup is not that smart, and a "ps" (or grepping through /proc) will show the password on the command-line. If the backup server is a single user machine that you consider secure, this may not represent too much of a risk. On the other hand, if you want to eliminate this problem completely, skip the wrapper script and modify make_catalog_backup so that it uses hard-coded values from within the script instead of command-line parameters for the dbname, the dbuser, and the password. => => Regards, => => Simon Barrett => Mark Bergman [EMAIL PROTECTED] System Administrator Section of Biomedical Image Analysis 215-662-7310 Department of Radiology, University of Pennsylvania http://pgpkeys.pca.dfn.de:11371/pks/lookup?search=mark.bergman%40.uphs.upenn.edu - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
On 2007.10.24. 16:53, Dan Langille wrote: > On 24 Oct 2007 at 14:39, Simon Barrett wrote: ... >> On this matter; adding the password to the RunBeforeJob line causes my >> database password to appear on the status emails: >> >> 24-Oct 13:09 fs01-dir: BeforeJob: run command >> "/etc/bacula/make_catalog_backup >> bacula bacula MyPasswordHere" >> >> Status emails are sent in clear text across our network. Is there a >> recommended solution to include sensitive variables in the config files >> without exposing them like this? > > http://www.bacula.org/dev-manual/Catalog_Maintenance.html > > Click on Security considerations using bacula 2.2.5, there seems to be several problems with these suggestions. one (when not running director as root) i am outlining in another email, "problems when not running director as root". another one is that even if i hardcode password in the make_catalog_backup scripts, something prints the password to messages, if python scripting is enabled. the line looks a bit weird, as it contains what seems to be another line at the end. 30-Oct 11:40 backup_1-dir JobId 52: ('bacula', None, 'bacula', 'baculapassword', None, 0, 'MySQL')30-Oct 11:40 backup_1-dir JobId 52: python script is slightly modified default example, and looking over it, i can't see any report line which could output anything like that. what could be the reason for this line ? -- Rich - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
Hi, 30.10.2007 10:54,, Rich wrote:: > On 2007.10.24. 16:53, Dan Langille wrote: >> On 24 Oct 2007 at 14:39, Simon Barrett wrote: > ... >>> On this matter; adding the password to the RunBeforeJob line causes my >>> database password to appear on the status emails: >>> >>> 24-Oct 13:09 fs01-dir: BeforeJob: run command >>> "/etc/bacula/make_catalog_backup >>> bacula bacula MyPasswordHere" >>> >>> Status emails are sent in clear text across our network. Is there a >>> recommended solution to include sensitive variables in the config files >>> without exposing them like this? >> http://www.bacula.org/dev-manual/Catalog_Maintenance.html >> >> Click on Security considerations > > using bacula 2.2.5, there seems to be several problems with these > suggestions. > > one (when not running director as root) i am outlining in another email, > "problems when not running director as root". > another one is that even if i hardcode password in the > make_catalog_backup scripts, something prints the password to messages, > if python scripting is enabled. > > the line looks a bit weird, as it contains what seems to be another line > at the end. > > 30-Oct 11:40 backup_1-dir JobId 52: ('bacula', None, 'bacula', > 'baculapassword', None, 0, 'MySQL')30-Oct 11:40 backup_1-dir JobId 52: > > python script is slightly modified default example, and looking over it, > i can't see any report line which could output anything like that. The above looks like a printout of the CatalogRes provided as an attribute by Baculas job object. Arno > what could be the reason for this line ? -- Arno Lehmann IT-Service Lehmann www.its-lehmann.de - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users
Re: [Bacula-users] Problem backing up catalog
On 2007.10.30. 12:05, Arno Lehmann wrote: ... >> the line looks a bit weird, as it contains what seems to be another line >> at the end. >> >> 30-Oct 11:40 backup_1-dir JobId 52: ('bacula', None, 'bacula', >> 'baculapassword', None, 0, 'MySQL')30-Oct 11:40 backup_1-dir JobId 52: >> >> python script is slightly modified default example, and looking over it, >> i can't see any report line which could output anything like that. > > The above looks like a printout of the CatalogRes provided as an > attribute by Baculas job object. ah, indeed - i was looking for report lines, missed print lines... print job.CatalogRes seems that default example script suffers from some problems :) > Arno > >> what could be the reason for this line ? -- Rich - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ ___ Bacula-users mailing list Bacula-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bacula-users