[Samba] Automated samba online backup.

[Andrew Bartlett]

I would strongly recommend against this 'solution'.  Unless you lock
the Samba DB during the backup, you cannot know that the DB is in a
consistent state to take the backup. 

The same concerns expressed for PostgreSQL apply to Samba:

https://www.postgresql.org/docs/9.1/backup-file.html

Andrew Bartlett

On Fri, 2021-03-19 at 13:17 -0500, Christopher Wensink via samba wrote:
> We accomplish what your asking without asking for an admin password,
> but 
> it's not done through samba-tool.  We have an external Synology NAS 
> device with 72 TB of total storage, that remotely connects into the 
> samba file share machine each night, and takes a file system backup. 
> It 
> additionally takes a full VM backup each night via a system snapshot.
> 
> There is no direct connection for the samba machine to connect to
> the 
> Synology, the Synology is reaching in and pulling out backups, this
> way 
> if the samba file share machine is compromised it will not affect
> the 
> backup machine.  DSM w/ Active Backup for business has worked pretty 
> well for us, and there are options to simply use rsync  on a shell
> on 
> the device if you want to do things that way too.  We went with a 12
> bay 
> Rackmount model, but there are consumer budget friendly devices 
> available that have have the same functionality.
> 
> Chris
> 
> On 3/19/2021 1:10 PM, Andrew Bartlett via samba wrote:
> > On Thu, 2020-04-30 at 10:27 -0300, Daniel Lopes de Carvalho via
> > samba
> > wrote:
> > > Hi
> > > 
> > > I'm looking for a way to automate samba online backup with cron
> > > and
> > > without
> > > asking admin password. I wish to have a daily backup from my AD.
> > > 
> > > Is there a way to exec samba-tool domain backup without password
> > > or
> > > do I
> > > need to have a export a admin keytab or something like that.
> > > 
> > > Thanks
> > (sorry for the late reply)
> > 
> > In theory a keytab might work, and from there something that
> > refreshes
> > a credentials cache, but that is as sensitive as a password anyway.
> > 
> > An offline backup is what you want in cron, and we are currently
> > tidying up some of the rough edges on that.  If you see any issues
> > using the offline backup in your situation please file a bug.  We
> > are
> > fixing the incompatibility with BIND9_DLZ.
> > 
> > I hope this clarifies things,
> > 
> > Andrew Bartlett
> > 
> 
> -- 
> Christopher Wensink
> IS Administrator
> Five Star Plastics, Inc
> 1339 Continental Drive
> Eau Claire, WI 54701
> Office:  715-831-1682
> Mobile:  715-563-3112
> Fax:  715-831-6075
> cwensink at five-star-plastics.com
> www.five-star-plastics.com
> 
> 
> 
-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions