Backup up CIFS via samba mount in Linux

Question

Is this possible? I have added an AD domain user to the backup operators group (in both domain and on the celerra CIFS server). I have mounted the CIFS shares as a SAMBA mount using the aforementioned user. I can mount the share successfully but get permission denied when trying to browse any sub directories.

Shouldn't the backup operators group members be able to see all files on the CIFS server?

No error messages in server_log on control station or on the linux box thsat can pin point the problem. It's as if the user is just operating as a normal user and not part of the backup operators group.

Any pointers would be much appreciated.

SAMEERK1 · Answer

Hi,

can you please tell me how you have mounted the cifs on samba client, can you please provide the complete command used to do that and also you can try

the workaround as per me,

if you have mounted the cifs shares using -t smbfs, then you try mounting it by using -t cifs and try accessing the directories.

Let me know if that worked.

Thanks

Sameer Kulkarni

Rainer_EMC · Answer

plus Backup Operator is not a right - it's a privilege

meaning you don't get special access by default - a backup application has to be specifically coded to invoke it

it won't do you any good for regular Programs like the shell or tar / dump ...

Rainer

P.S.: please keep in mind that Linux CIFS clients are not officially supported by EMC

dynamox · Answer

Backup operator can 'backup' the data ..not necessarily read it. http://technet.microsoft.com/en-us/library/cc722456.aspx

roycrom · Answer

This is the line as I have it in fstab

//CIFS-Server/c$ /export/home/CIFS-Server cifs rw,credentials=/etc/samba/.smbpassword.CIFS-Server 0 0

and then just a

# mount /export/home/CIFS-Server

Equivilent to

# mount -t cifs

The user contained in /etc/samba/.smbpassword.CIFS-Server is the AD user with domain backup operators membership and also backup operators membership in local group on CIFS-Server.

I cannot change into subdirectories as shown below when the CIFS share is mounted as that user.

# pwd

/export/home/CIFS-Server

# ls

sub-dir

# cd sub-dir

permission denied

However, If I mount this as a user who has file system permissions on this CIFS server's directories then I can back it up succesfully, and that user is not a member of the backup operators group.

I do not want to start cascading priviliges down the tree. I thought that the purpose of the backup operators group was that members could backup files without having explicit file system permissions. However, I am a linux sysadmin - not a windows one. Please correct me if I am wrong on any of the above points.

Many thanks

Rainer_EMC · Answer

not only that - its not a general right or permission - its useless unless the application invokes the NTFS backup API

see http://technet.microsoft.com/en-us/library/dd277311.aspx

Backup files and directories

(SeBackupPrivilege)

Allows the user to circumvent file and directory permissions to backup the system. The privilege is selected only when the application attempts to access through the NTFS backup application interface. Otherwise normal file and directory permissions apply.

I highly doubt that any Unix/Linux application has a chance to invoke that through the Unix file system interfaces

so if you want to go that route for LAN backup your choices are:

- permission a Windows account so that it has access to all the data

- use an NFS mount and be limited to not backing up the Windows ACLs

- use a Windows box to run your backup

Rainer

Rainer_EMC · Answer

you're welcome

you could also look at FMA file archving - if you archive older files to a file system that doesnt have to be backed up that often, it can reduce the backup time for the primary file system

Rainer

roycrom · Answer

Thanks Rainer,

That makes sense,

we are trying to reduce our backup time window for the NAS. We are currently using NDMP which works great but we are limited to 4 threads on our NS40. We have around 12 TB to pull for the full backup which is taking the best part of the weekend.

We wanted to try backing up through a linux media server using NetBackup and although the initial time would have been more, we were then going to produce synthetic fulls to reduce the time taken to backup once the initial full was in place.

Looks like the only way we could do this would be to use a Windows server as the media server and backup through there. Disk pack would be directly attached.

Thanks again for your advice, it is much appreciated.

Celerra

Backup up CIFS via samba mount in Linux

Was this post helpful?