Question about permissions creating local archives as root or user in a script

[jncosideout]

Have you checked borgbackup docs, FAQ, and open GitHub issues?

Yes

Is this a BUG / ISSUE report or a QUESTION?

Question

System information. For client/server mode post info for both machines.

Your borg version (borg -V).

borg 1.2.0

Operating system (distribution) and version.

Ubuntu 18.04

Hardware / network configuration, and filesystems used.

local repo, external usb SSD, ext4

How much data is handled by borg?

less than 500G

Full borg commandline that lead to the problem (leave away excludes and passwords)

Describe the problem you're observing.

I would just like to know how to modify the sample script for automated local backups
(found in the docs here https://borgbackup.readthedocs.io/en/stable/deployment/automated-local.html)
so that I can create separate archives for the root user and my user.

I have read through several Issues like #3864, #7504, #3587, etc. and want to avoid the "Permission mixup" issue when extracting or dealing with my archives later. I concluded I should make my system backup as root and my home backup as my user. But since I'm following the guide above, this is a systemd service that will run the script as root, so won't both my system and home archives be owned by root? I want my home archive to be owned by my user and all my home files to have the correct permissions for my user. From what I've researched, it sounds like making both archives as root will mix up or drop those permissions since I will need to use sudo when I extract or copy my files from my home user archive. Should I switch to my home user in the script when creating my home archive?

Also, I'm running into another error while running the script as root and making an archive on a repo that was initialized by my user
No key file for repository /mnt/borg-backup-disk/borg-backups/backup_local.borg found in /root/.config/borg/keys
Should I set the BORG_KEY_FILE or BORG_CONFIG_DIR environment variables?

Can you reproduce the problem? If so, describe how. If not, describe troubleshooting steps you took before opening the issue.

This is partly a hypothetical problem, I haven't encountered it yet.

Include any warning/errors/backtraces from the system logs

[ThomasWaldmann]

Simple configuration:

• run all backups as root, repo is owned by by root, all repo access must be done as root
• you could do all backups / prune / compact in one script

Complex configuration 1:

• backup system as root
• backup each user as the respective user
• have scripts for system / for each user

Complex configuration 2:

• access the repos via ssh://borg@host:port/path/to/repoN, repos are owned by user "borg" and always accessed by user "borg", use "repokey" for simplicity
• host can be some remote host or localhost
• you can access the repos from any user you want without causing a permission mixup (because only "borg serve" accesses the repo files and that always runs as user "borg"), the clientside user will just need to have the passphrase.

If you use "keyfile" modes, you'll additionally have the issue that the user needs to have the keyfile, so "repokey" is simpler.

[jncosideout]

Thanks. Those options make sense. Two more questions:

If I go with "Complex configuration 1" would it be easier to make the repos separate as well? Then I could init one as root for the system repo, and init the other as myself for my home repo. Would this simplify using keyfile mode in the scripts?

If I go with "Complex configuration 2" will I still need to generate ssh keys even though I'm using localhost? I.e. is this option the same configuration and steps used with a remote host?

[ThomasWaldmann]

CC1 must use 1 separate repo per different user. If you always use the correct user, which you should, you can also use keyfile here.

CC2: Yes, you need to generate ssh keypair(s) for this (without passphrase usually, so stuff can run automated). Same setup as for a remote host.

[jncosideout]

Great I'll give these methods a try. You can close this, but I may come back with more questions. Thanks again!

[jncosideout]

I'm using CC1 and things are coming along, but I found that the keyfile for the repo I made as sudo is in my user's home ~/.config/borg/keys, not /root/.config/borg/keys

sudo ls -l /root/.config/borg/keys
total 0

 ls -l ~/.config/borg/keys
-rw------- 1 myuser myuser  813 Jul 11 20:30 mnt_borg_backup_disk_borg_backups_backup_local_borg
-rw------- 1 myuser myuser  813 Jul 15 13:23 mnt_borg_backup_disk_borg_backups_backup_local_system_borg
-rw------- 1 root  root   813 Jul 15 13:30 mnt_borg_backup_disk_borg_backups_backup_local_system_borg.2

And as you see here there is backup_local_system.borg as well as backup_local_system.borg.2 because I accidentally made the first one as myuser, not root.

How should I make the backup_local_system_borg as root with the correct keyfile? Should I just move the keyfile for backup_local_system_borg.2 into root's borg config keys dir? Or start over and make it as root in a way that uses root's environment? I'm guessing using sudo keeps myuser's environment.

[jncosideout]

ok after reading the docs I think I see why the keyfile for my system backup was in my home borg config dir and not root's

BORG_CACHE_DIR
Defaults to $BORG_BASE_DIR/.cache/borg.

so should I have temporarily set BORG_BASE_DIR to /root before initializing my system repo for the root user?

TEMP_BORG_CACHE_DIR=$BORG_CACHE_DIR
BORG_CACHE_DIR=/root
sudo borg init -e keyfile /path/to/system_repo
BORG_CACHE_DIR=$TEMP_BORG_CACHE_DIR

[ThomasWaldmann]

Well, borg does what you tell it to do.

So if you use BORG_* env variables, you have to make sure they have correct values.

BORG_BASE_DIR influences all directories used (IIRC) and you should only use that if you really want that.

The default for most of the directories is to be inside the home directory and that usually is ok, except maybe for the cache if you have limited space there (like e.g. for a rather small root filesystem, space inside /root could be to small for borg's caches).

[jncosideout]

alright, thanks, I understand. To get around having a keyfile in root's borg config dir to make my system repo backups, I'll use repokey instead. I successfully finished a backup of my home dir last night. It took 13 hours to backup 289 GB. I have enjoyed learning about borg and will continue to use it.
I appreciate all your help. You may close this issue now.

[jncosideout]

Hi again. I've decided to try making my system backup using the "Complex Configuration 2" as we discussed previously. It's still a little unclear to me how to create and access the repo this way, using ssh and treating it as a remote repo.

For my purposes, you said

(remote) repos are owned by user "borg" and always accessed by user "borg"

• Does this "borg user" exist internally in the borg client, or do I need to create it on my system i.e. in /etc/passwd?
• To init the repo, which command should I run?
  borg init myUser@localhost:/path/to/repo or
  borg init borg@localhost:/path/to/repo

you can access the repos from any user you want without causing a permission mixup (because only "borg serve" accesses the repo files and that always runs as user "borg"), the clientside user will just need to have the passphrase.

The passphrase you referred to is the encryption key passphrase correct? Not the ssh key's, right? (assuming I take your advice and "generate ssh keypair(s) for this (without passphrase usually, so stuff can run automated)."

Supplying a passphrase to an automated script is tricky when running my script as root (I'm using the popular pass cli password manager). But if I setup this repo correctly as a "remote/ssh" repo on localhost, I won't need to run the script as root, since the repo will belong to the borg user? (or my user if I init the repo as myself?)

[ThomasWaldmann]

The client/server setup is also described in our docs (the only difference it that in the CC2 case, both client and server is the same machine).

Yes, you need to create that "borg" user and you ssh to borg@localhost then. "borg serve" will then run as that user and the repo files will be owned by "borg" user.

https://borgbackup.readthedocs.io/en/stable/quickstart.html