Amanda-Users

Re: amrestore: NAK: user root from localhost is not allowed to execute the service amindexd

2009-03-01 20:57:31
Subject: Re: amrestore: NAK: user root from localhost is not allowed to execute the service amindexd
From: Charles Curley <charlescurley AT charlescurley DOT com>
To: John Hein <jhein AT timing DOT com>
Date: Sun, 1 Mar 2009 18:54:28 -0700
On Sun, Mar 01, 2009 at 05:49:20PM -0700, John Hein wrote:
> Charles Curley wrote at 16:53 -0700 on Mar  1, 2009:
>  > On Sun, Mar 01, 2009 at 02:18:27PM -0700, Charles Curley wrote:
>  > > On Sun, Mar 01, 2009 at 12:50:50PM -0700, John Hein wrote:
>  > > > Do you know how your stock ubuntu build of amanda was configured (the
>  > > > args to configure)?
>  > > > 
>  > > > I just noticed that the request came from 'localhost' which does
>  > > > not match your .amandahosts entry.
>  > > 
>  > > Short of pulling in the source package and looking at that, I have no
>  > > idea. I don't even know how to find out, other than ask on another
>  > > list.
> 
> Yep, this is an example of one disadvantage of using prebuilt packages.
> 
> 
>  > > I also don't see any way to override the host name. -o host and -o
>  > > hostname are rejected.
> 
> man amrecover (see -s & -t).  I don't know if there is a run-time
> configuration option for these (I didn't see one after a quick read
> of the man pages) - if so, -o would be of no help.

Those set the index and tape servers, respectively. Supposedly, you
can also do that with environmental variables. I tried environmental
variables, and they didn't work.

> 
> 
>  > For what it's worth, I came up with a work-around. On the server, I
>  > added localhost.localdomain to .amandahosts, ran amrecover, and that
>  > worked.
> 
> Yes, that is what I was getting at.  Good to hear it worked for you.
> 
> 
>  > --------------------------------------------------
>  > chaffee.localdomain backup amdump
>  > chaffee.localdomain root amindexd amidxtaped
>  > localhost.localdomain root amindexd amidxtaped
>  > --------------------------------------------------
>  > 
>  > root@chaffee:~/test# amrecover 
>  > AMRECOVER Version 2.5.2p1. Contacting server on localhost ...
>  > 220 chaffee AMANDA index server (2.5.2p1) ready.
>  > Setting restore date to today (2009-03-01)
>  > 200 Working date set to 2009-03-01.
>  > 200 Config set to DailySet1.
>  > 501 Host chaffee is not in your disklist.
>  > Trying host chaffee.localdomain ...
>  > 200 Dump host set to chaffee.localdomain.
>  > Use the setdisk command to choose dump disk to recover
>  > amrecover> help
>  > 
>  > From there, sethost, setdisk, setdate, and it looks like I'm on my
>  > way.
>  > 
>  > But this is not The Way It's Supposed To Work, is it?
> 
> Not sure what you mean.  If someone configured the build of amanda
> (specifically the amrecover part of amanda in this case) with
> --with-index-server=localhost, then, yes, what you experienced is the
> expected behavior.

I mean that amrecover should work on the client. It doesn't seem to be
a good idea for a large shop to allow folks root access on the Amanda
server so they can restore files. Of course, with virtual tapes, you
have to give the operator root access so he can play with
symlinks. (Or has that gotten better since I last played with them?)


> 
> If you are asking if most people configure amanda that way, I'd say
> probably not, but who knows - I can say that I don't.  If you want,
> you can take it up with the debian/ubuntu packager.  FWIW, the default
> in the configure script if you don't specify --with-index-server is
> `uname -n`.

Which in a precompiled package would give you the host name of the
build machine, rather useless for the rest of the universe. How about
having it call the OS to enquire, and providing an option to override?
But that has its own security problems.

> 
> If you want better control, you can build amanda from source
> yourself.

Thanks. I'll pass.

Anyway, thanks for helping me out.


-- 

Charles Curley                  /"\    ASCII Ribbon Campaign
Looking for fine software       \ /    Respect for open standards
and/or writing?                  X     No HTML/RTF in email
http://www.charlescurley.com    / \    No M$ Word docs in email

Key fingerprint = CE5C 6645 A45A 64E4 94C0  809C FFF6 4C48 4ECD DFDB

Attachment: signature.asc
Description: Digital signature