Proposal: Enhancing Bacula Secret Management - file:, dynfile:, syscred:, and credstore:
Clinton Bunch <[email protected]> Wed, 25 Jun 2025 13:49:00 -0500
| Newsgroups | gmane.comp.sysutils.backup.bacula.devel |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============4320876644920302526==
Content-Type: multipart/alternative;
boundary="------------B8ACzCgDSffpS4IYjOlQnfd1"
Content-Language: en-US
This is a multi-part message in MIME format.
--------------B8ACzCgDSffpS4IYjOlQnfd1
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Hello Bacula Developers and Community,
I'd like to initiate a discussion around enhancing how Bacula manages
sensitive information like passwords and potentially TLS key
passphrases, moving them out of the main configuration files. This aims
to improve security, simplify secret rotation, and make Bacula
configurations more friendly for version control and modern deployment
practices (e.g., with Ansible, Puppet, systemd). Importantly, these
proposed enhancements would be entirely optional, ensuring no breakage
for existing configurations.
Currently, passwords are often embedded directly in bacula-*.conffiles.
This has several drawbacks:
*
Exposes secrets if the main config files are inadvertently shared or
checked into version control without protection.
*
Makes secret rotation more error-prone as it requires editing the
main config.
*
Complicates management with configuration automation tools that
might handle secrets separately.
I propose a few layered approaches to address this, ranging from simpler
to more comprehensive:
*1. The file:Directive*
Many users might want to separate files for secrets and pointing to them
with restrictive permissions, which is good practice. A Password =
"file:/path/to/secret"directive that simply reads the first line of a
file (stripping any trailing newline) would be a foundational improvement.
*
*Advantages*:
o
Allows separation of secrets from main configuration.
o
Easier secret rotation (update file, reload Bacula).
o
Configuration files become safer for version control (secret
files are gitignored/managed separately).
o
Aligns well with configuration management tools (e.g., Ansible
can deploy the main config and then deploy the secret file with
strict permissions and content from a vault).
*2. The dynfile:Directive (Dynamic/Deferred File Loading)*
Building on file:, the dynfile:prefix would address scenarios where the
secret file is provisioned at service startup and might not exist when a
configuration check (bacula-* -t) is run. This is particularly relevant
for integration with systemd-credentials.
*
*Syntax*: Password = "dynfile:/path/to/runtime_secret_file"
*
*Key Behavior*:
o
During a configuration test (bacula-* -t), if a dynfile:path
does not exist, Bacula should issue a warning or informational
message but *not fail the configuration check*. The validity of
the rest of the configuration can still be assessed.
o
At actual runtime, if the dynfile:path doesn't exist when the
secret is needed, it would be a fatal error.
*
*Advantages*:
o
All benefits of file:.
o
Crucially enables seamless integration with tools like
systemd-credentials(e.g., LoadCredential=), which make secrets
available only after the service unit starts processing but
before the main daemon fully initializes.
o
Useful for any custom startup script that generates/places a
temporary secret file.
*3. The syscred:Directive (Direct systemd-credentials Integration)*
For a more streamlined systemd integration, a dedicated prefix could
simplify configuration since the path used by systemd for
$CREDENTIALS_DIRECTORYis not guaranteed to remain the same between
systems or systemd versions.While there might be a natural reluctance to
add code specific to one OS's init system/credential manager, the
prevalence of systemd on Linux platforms and the relative ease of
implementing this specific integration could offer a significant "bang
for the buck" for a large portion of the user base.
*
*Syntax*: Password = "syscred:credential_name"(e.g.,
syscred:bacula_db_password)
*
*Behavior*:
o
Bacula reads the $CREDENTIALS_DIRECTORYenvironment variable (set
by systemd).
o
It constructs the full path: $CREDENTIALS_DIRECTORY/credential_name.
o
It attempts to read the secret from this path.
o
It inherits the "don't fail early" logic from dynfile:for
configuration checks (if $CREDENTIALS_DIRECTORYisn't set or the
path doesn't yet exist during -t).
*
*Advantages*:
o
Simplifies configuration for users on systemd: they only need
the credential name, not the full runtime path.
o
More robust as it adapts to the actual path provided by systemd
via $CREDENTIALS_DIRECTORY.
o
Represents a relatively "simple win" for a large and growing
portion of the Linux user base, offering a clean, secure, and
modern way to handle secrets.
o
Implementation could leverage the underlying logic developed for
dynfile:, making it a comparatively straightforward addition.
*Applicability to TLS Keys/Passphrases:*
These file:, dynfile:, and syscred:mechanisms could also be extended to
directives like a new TLS Key Passphraseif Bacula were to support
encrypted TLS private keys (leveraging the linked OpenSSL library which
can handle decryption given a passphrase). This would be a significant
security hardening step for TLS keys. TLS Key =
"dynfile:/path/to/key_provided_by_systemd"is also an option if systemd
provides the decrypted key directly.
*4. The credstore:name:secret_identifierDirective (External Credential
Store Helper)*
For maximum flexibility and integration with various secret managers
(Vault, AWS Secrets Manager, Azure Key Vault, etc.) and platforms:
*
*Syntax*:
*
In resource: Password =
"credstore:myvault:database/production/db_password"
*
New Stanza:
|Credstore { Name = "myvault" Exec =
"/usr/local/bin/bacula-secret-helper --store vault --secret %s"
# Or: Exec = "/usr/local/bin/fetch-from-aws --secret %s" Timeout
= 5 # Optional timeout for the helper }|
*
*
*Behavior*:
o
Bacula forks and executes the specified Execcommand,
substituting %s(or other placeholders) with the secret_identifier.
o
The helper script/program is responsible for fetching the secret
from the external store and printing it to its standard output.
o
Bacula reads the secret from the helper's stdout.
*
*Advantages*:
o
Extremely flexible: supports any secret manager via custom
helper scripts.
o
Platform-agnostic core mechanism (exec).
o
Aligns with how many other enterprise tools manage externalized
secrets.
*
*Considerations*:
o
Significantly more involved to implement in Bacula (process
management, IPC, timeout handling, error checking from helper,
argument substitution).
o
Potential performance implications if secrets are fetched very
frequently (though caching within Bacula could mitigate this).
o
Careful design needed for config check mode (e.g., should
helpers be executed?).
*Discussion Points:*
*
Is there general interest in these types of enhancements,
understanding they would be optional additions?
*
*
Would the proposed file:directive be a welcome foundational feature?
*
Following that, would dynfile:(with its specific config-check
behavior) be a good next step?
*
Given its potential ease of implementation and wide user base on
systemd, is syscred:a desirable simplification, despite being
OS-specific?
*
Is the more comprehensive credstore:exec:model something the
community sees a long-term need for, despite the implementation effort?
*
Are there other approaches or considerations I might have missed?
I believe even the simpler dynfile:and syscred:options would offer
substantial benefits to many Bacula users by improving security and
manageability without impacting existing setups. The credstore:approach
provides a path for even more advanced integrations.
Looking forward to your thoughts and feedback.
Thanks,
Clinton Bunch
--------------B8ACzCgDSffpS4IYjOlQnfd1
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html>
<html>
<head>
<meta http-equiv=3D"content-type" content=3D"text/html; charset=3DUTF=
-8">
</head>
<body>
<p><span _ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><spa=
n
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Hel=
lo
Bacula Developers and Community,</span></p>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><spa=
n
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">I'd
like to initiate a discussion around enhancing how Bacula
manages sensitive information like passwords and potentially
TLS key passphrases, moving them out of the main
configuration files. This aims to improve security, simplify
secret rotation, and make Bacula configurations more
friendly for version control and modern deployment practices
(e.g., with Ansible, Puppet, systemd). </span><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><sp=
an
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">I=
mportantly,
these proposed enhancements would be entirely optional,
ensuring no breakage for existing configurations.</span></s=
pan></p>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><spa=
n
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Cur=
rently,
passwords are often embedded directly in </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">bacula-*.conf</span><s=
pan
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">
files. This has several drawbacks:</span></p>
<ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>Exposes
secrets if the main config files are inadvertently
shared or checked into version control without
protection.</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>Makes
secret rotation more error-prone as it requires editing
the main config.</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>Complicates
management with configuration automation tools that
might handle secrets separately.</span></p>
</li>
</ul>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><spa=
n
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">I
propose a few layered approaches to address this, ranging
from simpler to more comprehensive:</span></p>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><spa=
n
_ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<strong
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">1.
The </span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">file:</span><spa=
n
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
Directive</span></strong><span
_ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Many users might want
to separate files for secrets and pointing to
them with restrictive permissions, which is good
practice. A </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">Password =3D
<a class=3D"moz-txt-link-rfc2396E" href=3D"file:/=
path/to/secret">"file:/path/to/secret"</a></span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> directive that simply
reads the first line of a file (stripping any
trailing newline) would be a foundational
improvement.</span></p>
</span></p>
<ul _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><strong
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Advantages</span></s=
trong><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">:</span></p>
<ul _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Allows separation
of secrets from main configuration.</span></p=
>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Easier secret
rotation (update file, reload Bacula).</span>=
</p>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Configuration file=
s
become safer for version control (secret
files are gitignored/managed separately).</sp=
an></p>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Aligns well with
configuration management tools (e.g.,
Ansible can deploy the main config and then
deploy the secret file with strict
permissions and content from a vault).</span>=
</p>
</li>
</ul>
</li>
</ul>
</span></p>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<strong
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">2.
The </span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">dynfile:</span><=
span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
Directive (Dynamic/Deferred File Loading)</span></stron=
g><span
_ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Building on </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">file:</span><s=
pan
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">, the </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">dynfile:</span=
><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> prefix would address
scenarios where the secret file is provisioned at
service startup and might not exist when a
configuration check (</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">bacula-* -t</s=
pan><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">) is run. This is
particularly relevant for integration with </span><sp=
an
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">systemd-creden=
tials</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">.</span></p>
<ul _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><strong
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Syntax</span></stron=
g><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">: </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">Password =3D
"dynfile:/path/to/runtime_secret_file"</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><strong
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Key Behavior</span><=
/strong><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">:</span></p>
<ul _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">During a
configuration test (</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">bacula=
-*
-t</span><span _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">), if a </span><sp=
an
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">dynfil=
e:</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> path does not
exist, Bacula should issue a warning or
informational message but </span><strong
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">not fail the
configuration check</span></strong><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">. The validity of
the rest of the configuration can still be
assessed.</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">At actual runtime,
if the </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">dynfil=
e:</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> path doesn't exis=
t
when the secret is needed, it would be a
fatal error.</span></p>
</li>
</ul>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><strong
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Advantages</span></s=
trong><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">:</span></p>
<ul _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">All benefits of </=
span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">file:<=
/span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">.</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Crucially enables
seamless integration with tools like </span><=
span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">system=
d-credentials</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> (e.g., </span><sp=
an
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">LoadCr=
edential=3D</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">), which make
secrets available only after the service
unit starts processing but before the main
daemon fully initializes.</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Useful for any
custom startup script that generates/places
a temporary secret file.</span></p>
</li>
</ul>
</li>
</ul>
</span></p>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<strong
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">3.
The </span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">syscred:</span><=
span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
Directive (Direct systemd-credentials Integration)</spa=
n></strong></p>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>For
a more streamlined systemd integration, a dedicated
prefix could simplify configuration=C2=A0</span><span
_ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0"><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">since the path used by
systemd for </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">$CREDENTIALS_D=
IRECTORY</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> is not guaranteed to
remain the same between systems or systemd versions.<=
/span></span></span><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
> </span><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">While
there might be a natural reluctance to add code
specific to one OS's init system/credential manager,
the prevalence of systemd on Linux platforms and the
relative ease of implementing this specific
integration could offer a significant "bang for the
buck" for a large portion of the user base.</span></spa=
n></p>
<ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><strong
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Syntax</span></strong><s=
pan
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">: </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">Password =3D
"syscred:credential_name"</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> (e.g., </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">syscred:bacula=
_db_password</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">)</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><strong
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Behavior</span></strong>=
<span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">:</span></p>
<ul _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Bacula reads the </spa=
n><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">$CREDENTIA=
LS_DIRECTORY</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> environment variable
(set by systemd).</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">It constructs the full
path: </span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">$CREDENTIA=
LS_DIRECTORY/credential_name</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">.</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">It attempts to read th=
e
secret from this path.</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">It inherits the "don't
fail early" logic from </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">dynfile:</=
span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> for configuration
checks (if </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">$CREDENTIA=
LS_DIRECTORY</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> isn't set or the path
doesn't yet exist during </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">-t</span><=
span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">).</span></p>
</li>
</ul>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><strong
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Advantages</span></stron=
g><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">:</span></p>
<ul _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Simplifies
configuration for users on systemd: they only
need the credential name, not the full runtime
path.</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">More robust as it
adapts to the actual path provided by systemd
via </span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">$CREDENTIA=
LS_DIRECTORY</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">.</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Represents a relativel=
y
"simple win" for a large and growing portion of
the Linux user base, offering a clean, secure,
and modern way to handle secrets.</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Implementation could
leverage the underlying logic developed for </spa=
n><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">dynfile:</=
span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">, making it a
comparatively straightforward addition.</span></p=
>
</li>
</ul>
</li>
</ul>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<strong
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">Applicability
to TLS Keys/Passphrases:</span></strong><span
_ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0"><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d"><br>
</span></span></p>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<span
_ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0"><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">These
</span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">file:</span><spa=
n
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">,
</span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">dynfile:</span><=
span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">,
and </span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">syscred:</span><=
span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
mechanisms could also be extended to directives like a
new </span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">TLS Key
Passphrase</span><span _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> if Bacula were to support
encrypted TLS private keys (leveraging the linked
OpenSSL library which can handle decryption given a
passphrase). This would be a significant security
hardening step for TLS keys. </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">TLS Key =3D
"dynfile:/path/to/key_provided_by_systemd"</span><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
is also an option if systemd provides the decrypted
key directly.</span></span></p>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<strong
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">4.
The </span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">credstore:name:s=
ecret_identifier</span><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
Directive (External Credential Store Helper)</span></st=
rong><span
_ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">For maximum flexibility an=
d
integration with various secret managers (Vault, AWS
Secrets Manager, Azure Key Vault, etc.) and
platforms:</span></p>
</span></p>
</span></p>
</span></p>
<ul>
<li><span _ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><s=
trong
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><=
span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>Syntax</span></strong><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">:=
</span></p>
</span></li>
</ul>
<blockquote><span _ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0">
<ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>In
resource: </span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">Password =3D
"credstore:myvault:database/production/db_password"</span=
></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>New
Stanza:</span></p>
<span class=3D"mat-expansion-indicator ng-star-inserted"></sp=
an>
<div class=3D"mat-expansion-panel-content-wrapper">
<div role=3D"region" class=3D"mat-expansion-panel-content"
id=3D"cdk-accordion-child-81"
aria-labelledby=3D"mat-expansion-panel-header-81">
<div class=3D"mat-expansion-panel-body">
<div _ngcontent-ng-c289253575=3D""
class=3D"syntax-highlighted-code-wrapper">
<div _ngcontent-ng-c289253575=3D""
class=3D"syntax-highlighted-code">
<pre _ngcontent-ng-c289253575=3D""><code
_ngcontent-ng-c289253575=3D"">Credstore {
Name =3D <span class=3D"hljs-string">"myvault"</span>
Exec =3D <span class=3D"hljs-string">"/usr/local/bin/bacula-secret-help=
er --store vault --secret %s"</span>
<span class=3D"hljs-comment"># Or: Exec =3D "/usr/local/bin/fetch-from-=
aws --secret %s"</span>
Timeout =3D <span class=3D"hljs-number">5</span> <span
class=3D"hljs-comment"># Optional timeout for the h=
elper</span>
}</code>
</pre>
</div>
</div>
</div>
</div>
</div>
</li>
</ul>
</span></blockquote>
<p><br>
</p>
<ul>
<li><span _ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0">
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<strong
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">Behavior</span></strong><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>:</span></p>
<ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Bacula forks and executes
the specified </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">Exec</span><sp=
an
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> command, substituting </s=
pan><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">%s</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> (or other placeholders)
with the </span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">secret_identif=
ier</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">.</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">The helper script/program
is responsible for fetching the secret from the
external store and printing it to its standard
output.</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Bacula reads the secret
from the helper's stdout.</span></p>
</li>
</ul>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<strong
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">Advantages</span></strong><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>:</span></p>
<ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Extremely flexible:
supports any secret manager via custom helper
scripts.</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Platform-agnostic core
mechanism (</span><span _ngcontent-ng-c4063671643=3D"=
"
class=3D"inline-code ng-star-inserted">exec</span><sp=
an
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">).</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Aligns with how many other
enterprise tools manage externalized secrets.</span><=
/p>
</li>
</ul>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<strong
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">Considerations</span></strong><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>:</span></p>
<ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Significantly more involve=
d
to implement in Bacula (process management, IPC,
timeout handling, error checking from helper,
argument substitution).</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Potential performance
implications if secrets are fetched very frequently
(though caching within Bacula could mitigate this).</=
span></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Careful design needed for
config check mode (e.g., should helpers be
executed?).</span></p>
</li>
</ul>
</li>
</span></li>
</ul>
<p><span _ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><spa=
n
_ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<strong
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
><span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">Discussion
Points:</span></strong></p>
<ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Is there general interest
in these types of enhancements, understanding they
would be optional additions?</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c233927227=3D""
class=3D"router-outlet-wrapper ng-tns-c233927227-0">
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Would the proposed <=
/span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">file:</s=
pan><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> directive be a
welcome foundational feature?</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">
<p _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Following that, woul=
d
</span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">dynfile:=
</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> (with its specific
config-check behavior) be a good next step?</sp=
an></p>
</li>
</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Given its potential ease o=
f
implementation and wide user base on systemd, is </sp=
an><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">syscred:</span=
><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> a desirable
simplification, despite being OS-specific?</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Is the more comprehensive =
</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">credstore:exec=
:</span><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"> model something the
community sees a long-term need for, despite the
implementation effort?</span></p>
</li>
<li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte=
d">
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert=
ed"><span
_ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted">Are there other approaches
or considerations I might have missed?</span></p>
</li>
</ul>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>I
believe even the simpler </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">dynfile:</span><sp=
an
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>
and </span><span _ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">syscred:</span><sp=
an
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>
options would offer substantial benefits to many Bacula
users by improving security and manageability without
impacting existing setups. The </span><span
_ngcontent-ng-c4063671643=3D""
class=3D"inline-code ng-star-inserted">credstore:</span><=
span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>
approach provides a path for even more advanced
integrations.</span></p>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>Looking
forward to your thoughts and feedback.</span></p>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>Thanks,</span></p>
<p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">=
<span
_ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"=
>Clinton
Bunch<br>
</span><span _ngcontent-ng-c4063671643=3D""
class=3D"ng-star-inserted"></span></p>
</span></p>
</span></p>
</body>
</html>
--------------B8ACzCgDSffpS4IYjOlQnfd1--
--===============4320876644920302526==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============4320876644920302526==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Bacula-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bacula-devel
--===============4320876644920302526==--