On Mon, Nov 22, 2004 at 02:05:16AM +0100, Thorsten Bremer wrote:
> Moin Paul,
> 
> >> I just needed to restore some deleted files via amrecover and it works
> >> well. But I noticed that the files will be restored with the ownership
> >> "backup:backup" instead of the original "thoddi:users".
> 
> > You should restore as user "root", not as user "backup".
> 
> Well, why this? Another one on this list told me that all
> Amanda-operations should NOT be done as root, but as the backup-user.
> 
> After adding extra root-entries to the amndahosts, it now works,
> thanks. But I don't understand why I have to backup as "backup" and
> must restore as "root"...

Root privleges are needed for both.

The difference is that the backup programs are likely to
run unattended, or by an operator and the result is a collection
or archive of all the files, possibly on tape.  To get root
privlege during backup, certain programs are "setuid'ed" to
root.  Thus they can, and should be run by the backup user
despite needing root privlege for certain operations.

On recovery of files you do not want this situation.  That
would allow an ordinary user, or a backup operator, to
restore files they do not own, and possibly should never see.
Root has to be trustworth :)) I mean she can see everything
anyway right?  And to chown a file, root privlege is needed.
Try to chown a file as an ordinary user.  Most unix systems
forbid ordinary users from changing ownership, even of their
own files.

There are several reason for the restricting on chown.  I'll
just relate one from personal experience.  Some systems place
a quota on the maximum disk space a user can take up.  Also,
some systems charge for disk space used.  Long-Long ago, when
ordinary users could chown their files, I was on a system that
charged for space used.  My monthly bill was > $1000.  My
budget (a research grant) only allowed $400/month.  So I used
chmod to reset the permissions on lots of my large files so
anyone could read and write.  Then I gave them to other, richer
professors at the university.

For a few months, until my game was discovered, my bill dropped
to about $300/month.

jl
-- 
Jon H. LaBadie                  jon AT jgcomp DOT com
 JG Computing
 4455 Province Line Road        (609) 252-0159
 Princeton, NJ  08540-4322      (609) 683-7220 (fax)