Creating backup daemon users/groups

[Rick DeBay]

I'd like to create a daemon user who would manage backups. Would this user and
their group be created as system accounts instead of local? How do I create the
user with an invalid password to prevent login? Or do I have to edit
/etc/shadow myself and change the password to '*'?
Should I bother password protecting the daemon's group to prevent a user from
switching to the backup group?
I'm looking for best-practices, so if you can supply the reasoning for your
answer I'd appreciate it.

BTW, what is the existing daemon user and group (on Suse 10.2) used for? I hope
they don't use one system user to run all daemon type tasks.

Thanks, Rick DeBay

[Bill Marcum]

On 12 Mar 2007 07:36:34 -0700, Rick DeBay

Post by Rick DeBay
BTW, what is the existing daemon user and group (on Suse 10.2) used for? I hope
they don't use one system user to run all daemon type tasks.

find / -user daemon 2>/dev/null
On my system it finds some files used by cron, lpd and nfs.

[Rick DeBay]

Post by Bill Marcum
On 12 Mar 2007 07:36:34 -0700, Rick DeBay

Post by Rick DeBay
BTW, what is the existing daemon user and group (on Suse 10.2) used for? I hope
they don't use one system user to run all daemon type tasks.

find / -user daemon 2>/dev/null
On my system it finds some files used by cron, lpd and nfs.

Interesting. On mine,
sudo find / -user daemon
doesn't find anything. I let it report errors to see if I was doing something
wrong, but there were only two errors for a single process (/proc/29017/foo),
probably the one that was running the find.
But then it's a pretty lean installation.

Rick DeBay

[Mark Hobley]

Post by Rick DeBay
Should I bother password protecting the daemon's group to prevent a user from
switching to the backup group?

If a group has no password, it is not possible to switch to that group, unless
you are listed as a member. Adding a password would actually allow non-members
to switch to that group, if they know or guess the password.

Regards,

Mark.
--
Mark Hobley
393 Quinton Road West
QUINTON
Birmingham
B32 1QE

Telephone: [phone]
International: 0044 121 247 1596

Email: markhobley at hotpop dot donottypethisbit com

http://markhobley.yi.org/