Re: tar or zipping files to which you have no explicit access?

From: Mike Brown - Process Manager (mikebNOSPAM_at_NOSPAMassetforwarding.comNOSPAM)
Date: 03/12/04 

Date: Fri, 12 Mar 2004 14:47:12 GMT

"Tom Rodman" <Use-Author-Address-Header@[127.1]> wrote in message
news:200403121005.i2CA5ChC023555@tigris.pounder.sol.net...
> How can we "zip up" or tar
> users' directories to a single archive file. We
> do NOT want to limit the access rights end users can assign to their
> objects. After archiving the objects into to a single
> tar or zip file we want to be able to restore them preserving
> original ownership and ACLs.

At the very least, I would have the user with permissions as the local owner
of the backup script.

Perhaps if the user is the only one with access to his/her files, the user
could be responsible for backing them up. I agree in principle with much of
what you say below; however, Admins have control over things because we know
what we're doing, and if a user now decides that he knows what he is doing
as well, then that user will surely be wise enough to back up.

> We've tried granting ourselves the right to
>
> "backup files and directories"
> "restore files and directories"
>
> The show-stopper has been "Permission denied" errors on files
> for which we have no access rights - these could not be added to
> the tar archive.
>
> We're looking for a no cost solution using our free open source tools. My
> guess is the solution involves granting the process
> creating the backup file archive the proper rights.
>
> Clearly ntbackup can do this- but it only archives to tapes;
> if ntbackup could archive/restore to/from a file that would be
> fine - but it can not.
>
> why we do not want to restrict the permissions our end
> users assign to their own objects:
>
> o eventually there will be users that violate the rules, and or insist
> that they be allowed to do so. This can get
> political - you can not / will not always win political skirmishes.
> System admins are not always treated like gods by management.
>
> o IMHO users may have a valid reason for *not* granting the
administrators
> access to an object. Why should they be forced to? Our users are
software
> developers, perhaps they need to have very strict permissions for code
test
> cases. End users deserve respect, they pay for us with their work.
>
> o This attitude that user's should not be able to permissions to objects
> they own to what ever they want is IMHO arrogant, arrogant consistent
> with the worst of "Microsoft culture". In contrast UNIX has no such
> constraints - tools exist for "root" to backup all objects to a
non-tape
> archive regardless of their permissions or acls.
>
> o I can give you a specific example where a production database requires
a
> all objects below a given directory have an explicit ACL value
> that does *not* include system or administrators. If an object is
> changed to include either of the above groups, then the application
> will not work- at some point it will self repair by resetting all
> the permissions on the tree so that these groups are removed.
>
> o another example is cygwin's ssh client, for each ssh end user, their
> $HOME/.ssh/ dir should be set for access *only* by the user, no
access - not
> even read or execute to anyone else. I may not be entirely correct
> on this one, but I know the permissions on ~/.ssh/ are quite strict
> by design (it's a "secure shell" after all).
>
> o NTFS has an incredibly rich permissions capability - more so than
UNIX.
> To insist that administrators or system have full control to every
object
> "dumbs down" this richness and seems to contradict it's design.
>
>
> Any help would be appreciated; pls post *and* also e-mail me.
>
> thanks/regards,
> --
> Tom Rodman
> pls run this for my e-mail address:
> perl -e 'print unpack("u", "\.\=\$\!T\<F\]D\;6\%N\+F\-O\;0H\`");'

Relevant Pages

  • Re: tar or zipping files to which you have no explicit access?
    ... > users' directories to a single archive file. ... > do NOT want to limit the access rights end users can assign to their ... After archiving the objects into to a single ... perhaps they need to have very strict permissions for code ...
    (microsoft.public.win2000.security)
  • Re: tar or zipping files to which you have no explicit access?
    ... > do NOT want to limit the access rights end users can assign to their ... After archiving the objects into to a single ... perhaps they need to have very strict permissions for code ... > archive regardless of their permissions or acls. ...
    (microsoft.public.win2000.security)
  • Re: tar or zipping files to which you have no explicit access?
    ... > users' directories to a single archive file. ... > do NOT want to limit the access rights end users can assign to their ... After archiving the objects into to a single ... I would have the user with permissions as the local owner ...
    (microsoft.public.win2000.cmdprompt.admin)
  • Re: tar or zipping files to which you have no explicit access?
    ... > users' directories to a single archive file. ... > do NOT want to limit the access rights end users can assign to their ... After archiving the objects into to a single ... I would have the user with permissions as the local owner ...
    (microsoft.public.win2000.file_system)
  • Re: tar or zipping files to which you have no explicit access?
    ... After archiving the objects into to a single ... responsibility to do their own backups to prevent loss (assuming that is the ... System admins are NOT gods, and should not be treated as such. ... perhaps they need to have very strict permissions for code ...
    (microsoft.public.win2000.file_system)