0

I am trying to make a nightly offsite backup using rsync. There is a folder /media/raid1/backup that is to be uploaded to a different server every night using a cron job running as the user server_sync which exists on both boxes.

This is the rsync command:

#!/bin/bash
rsync -axz -e "ssh -p 222" --delete /media/raid1/backup/ filch:/backup_offsite --partial-dir /backup_offsite/.rsync_partial --exclude '*.old' --exclude 'old' --stop-at 06:00

When run interactively using sudo -H -u server_sync rsync... the command works just fine. The cron job, however, fails every night with this message (user names masked):

X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/home/server_sync>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=server_sync>
Date: Sun, 12 Aug 2018 03:00:11 +0200 (CEST)

rsync: opendir "/media/raid1/backup/j****" failed: Permission denied (13)
rsync: opendir "/media/raid1/backup/m*******" failed: Permission denied (13)
rsync: opendir "/media/raid1/backup/r***" failed: Permission denied (13)
IO error encountered -- skipping file deletion
rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1196) [sender=3.1.2]

The following are the permissions of the file to backup:

# ls -al /media/raid1/backup/
total 316
drwxr-s---  5 root     backup_sync  .
drwxr-xr-x 19 root     root         ..
drwxr-s---  3 j****    server_sync  j****
drwxr-s---  2 m******* server_sync  m*******
drwxr-s---  3 r***     server_sync  r***

The server_sync user is in both groups:

# id server_sync
uid=124(server_sync) gid=131(server_sync) groups=131(server_sync),129(backup_sync),130(media)

I'm sure I am missing something with either the file permissions or the permissions / group memberships I have when sudo-ing vs when in cron mode – can anybody point it out?

RenWal
  • 21
  • 5
  • 1
    Is selinux enabled? – Mark Wagner Aug 14 '18 at 23:44
  • @varlogtim No, it is not. It's in server_sync's crontab. I was only sudo-ing when I tested it from my account (so that it runs as the correct user), there is no sudo command in the crontab. – RenWal Aug 15 '18 at 13:47
  • @MarkWagner No, but AppArmor is. The log doesn't show any "denied" or "complain" messages though. – RenWal Aug 15 '18 at 13:52

1 Answers1

0

It seems that cron doesn't set up the additional groups. Run the id command from a cron job and write the result to a file, or to stdout and get it by mail.

RalfFriedl
  • 3,108
  • 4
  • 13
  • 17
  • Thanks! Anyway, cron gives me this, which looks sound to me: `uid=124(server_sync) gid=131(server_sync) groups=131(server_sync),129(backup_sync),130(media)` – RenWal Aug 15 '18 at 14:02