
#include "bacula_template.inc" title="Security Issues" num=17


<h1>Bacula Security Issues</h1>
<ul>
<li>The Clients (<b>bacula-fd</b>) must run as root to be able to access
    all the system files.</li>
<li>It is not necessary to run the Director as root.</li>
<li>It is not necessary to run the Storage daemon as root, but you
    must ensure that it can open the tape drives, which are often
    restricted to root access by default.</li>
<li>You should restrict access to the <b>Bacula</b> configuration files,
    so that the passwords are not world-readable. The <b>Bacula</b>
    daemons are password protected using CRAM-MD5 (i.e. the password is not
    sent across the network). This will ensure that not everyone
    can access the daemons. It is a reasonably good protection, but
    can be cracked by experts.</li>
<li>If you are using the recommended ports 9101, 9102, and 9103, you
    will probably want to protect these ports from external access
    using a firewall and/or using tcp wrappers (</b>etc/hosts.allow</b>).
    </li>
<li>Currently all data that is sent across the network is unencrypted.
    As a consequence, unless you use <b>ssh</b> for port forwarding,
    it is not recommended to do a backup across an insecure network
    (e.g. the Internet). In a future version, we plan to have <b>ssh</b>
    encryption built-in.</li>
<li>You should ensure that the <b>Bacula</b> working directories are
    readable and writable only by the <b>Bacula</b> daemons.</li>
<li>If you are using <b>MySQL</b> it is not necessary for it to
    run with <b>root</b> permission. </li>
<li>The default <b>Bacula</b> <b>grant-mysql-permissions</b> script
    grants all permissions to use the MySQL database without a 
    password. If you want security, please tighten this up! </li>
<li>Don't forget that Bacula is a network program, so anyone anywhere
    on the network with the console program and the Director's password
    can access Bacula and the backed up data.</li>
<li>You can restrict what IP addresses Bacula will bind to by using the
    appropriate <b>DirAddress</b>, <b>FDAddress</b>, or <b>SDAddress</b>
    records in the respective daemon configuration files.</li>
</ul>


<h2>TCP Wrappers</h2>
TCP Wrappers are implemented if
you turn them on when configuring (<b>./configure --with-libwrap</b>).
With this code enabled, you may control who may access your daemons.
This control is done by modifying the
file: <b>/etc/hosts.allow</b>. The program name that <b>Bacula</b>
uses when applying these access restrictions is the name you
specify in the daemon configuration file. This code is implemented but untested.

<page_prev name="FAQ" url="faq.html">
<page_next name="Thanks" url="thanks.html">
