8

Linux distributions contain several system user accounts such as daemon, bin, sys, etc. Debian includes an account for backup.

Is it alright to actually use this account? That is, give the account the ability to login via SSH so that it can do backups. I have done this and it works fine, but I am wondering if there is a reason this should not be done.

2
  • There is some information askubuntu.com/questions/63685/…
    – AlexD
    Commented Jan 21, 2022 at 10:41
  • @AlexD Thank you. That link kind of answers the question, but not fully. The Debian documentation quoted seems to ask if what it is saying is correct. I checked and even over 10 years latter the documentation is unchanged. There is no reason given for why these things are recommended and I was hoping for more insight about that.
    – A. Que
    Commented Jan 24, 2022 at 15:30

2 Answers 2

5
+50

The backup user is used by two backup programs in Debian, AMANDA and Cedar Backup. The amanda-server README.Debian gives details, and in particular it instructs users to change the backup user’s login shell and set up SSH keys for it.

If amanda-server uses the backup user in this fashion, I suspect that your usage is fine. There is one possible area for concern, the use of /var/backups as the backup user’s home directory; the issue was raised on the debian-devel mailing list back in 2000 but didn’t get any attention. (See also two discussions on /var/backups, from 2002 and 2004.)

1
  • Thanks for the well-researched answer. I've always wondered about this and now I know!
    – smammy
    Commented Aug 3, 2023 at 18:08
3

The backup user has logins disabled by having its shell as /usr/sbin/nologin, and its home directory is /var/backups... which does not seem to be empty.

If you run sudo grep -r var/backups /etc, you'll find a number of daily cron jobs that back up certain "essential" data to /var/backups:

  • package dpkg includes /etc/cron.daily/dpkg which maintains several rolling copies of the package manager state. Since dpkg is the low-level package manager, it is probably present in practically all installations of Debian.
  • the optional TUI package management tool aptitude does the same for its extra state information, with /etc/cron.daily/aptitude.
  • if you have samba installed, it saves a backup of /etc/samba/smbpasswd if it exists, to /var/backups/smbpasswd.bak.
  • if you have the OpenLDAP server slapd installed, it seems to also back up its schema under /var/backups/slapd-<package version number>.

In many cases, there seems to be 7 copies of each state file stored, similar to how logrotate keeps a rotating archive of past log files.

So it seems that there is (or was) a poorly-documented idea to collect daily copies of essential system metadata to /var/backups, and some packets are implementing it, while others aren't.

So at the very least, if you plan to use the backup user account for your own purposes, be aware that at least its default home directory /var/backups is likely to have a number of (small) extra files dumped to it daily. All the cron scripts I found so far have specified the directory explicitly as /var/backups, so if you change the user's home directory to something else, you most likely would escape the deluge.

2
  • 3
    Note, however, that none of these cron daily scripts use the backup user (or group), and all files at /var/backups, including that directory itself, are owned by root:root. So I believe /var/backups is mostly unrelated to the backup user
    – MestreLion
    Commented Mar 1, 2023 at 20:23
  • As I said, the default home directory of the backup user is defined as /var/backups. My answer was mostly just a warning that if you want to use the user account, you should change its home directory to something else to avoid surprises.
    – telcoM
    Commented Mar 3, 2023 at 12:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .