Re: Proposal: Enhancing Bacula Secret Management - file:, dynfile:, syscred:, and credstore:

--===============7380854268427786401==
Content-Type: multipart/signed; boundary="685c5958_20daabd1_9034"; 
 protocol="application/pgp-signature"

--685c5958_20daabd1_9034
Content-Type: multipart/alternative; boundary="685c5958_d9a50ed_9034"

--685c5958_d9a50ed_9034
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hi,

what you do in bigger deployments with a few hundred fd. You want change =
a few hundred different password or do you have the same password on all =
fd=3F

When your proposed password rotation does not work on a client what would=
 be your solution=3FBackup fail=3F

Also to make a dependancy of your Backup system to any 3rd part software =
is really a bad idea. In case of a disaster restore and your vault is gon=
e what you will do=3F

Regards
Reiner

> On Mittwoch, Juni 25, 2025 at 9:06 PM, Clinton Bunch <lists+bacula=40cl=
intonbunch.name (mailto:lists+bacula=40clintonbunch.name)> wrote:
>
> Hello Bacula Developers and Community,
>
>
> I'd like to initiate a discussion around enhancing how Bacula manages s=
ensitive information like passwords and potentially TLS key passphrases, =
moving them out of the main configuration files. This aims to improve sec=
urity, simplify secret rotation, and make Bacula configurations more frie=
ndly for version control and modern deployment practices (e.g., with Ansi=
ble, Puppet, systemd). Importantly, these proposed enhancements would be =
entirely optional, ensuring no breakage for existing configurations.
>
>
> Currently, passwords are often embedded directly in bacula-*.conf files=
. This has several drawbacks:
>
>
> Exposes secrets if the main config files are inadvertently shared or ch=
ecked into version control without protection.
>
>
>
> Makes secret rotation more error-prone as it requires editing the main =
config.
>
>
>
> Complicates management with configuration automation tools that might h=
andle secrets separately.
>
>
>
>
> I propose a few layered approaches to address this, ranging from simple=
r to more comprehensive:
>
>
>
>
>
> 1. The file: Directive
>
>
>
>
>
> Many users might want to separate files for secrets and pointing to the=
m with restrictive permissions, which is good practice. A Password =3D =22=
file:/path/to/secret=22 (file:/path/to/secret) directive that simply read=
s the first line of a file (stripping any trailing newline) would be a fo=
undational improvement.
>
>
> Advantages:
>
>
> Allows separation of secrets from main configuration.
>
>
>
> Easier secret rotation (update file, reload Bacula).
>
>
>
> Configuration files become safer for version control (secret files are =
gitignored/managed separately).
>
>
>
> Aligns well with configuration management tools (e.g., Ansible can depl=
oy the main config and then deploy the secret file with strict permission=
s and content from a vault).
>
>
>
>
>
>
> 2. The dynfile: Directive (Dynamic/Deferred =46ile Loading)
>
>
> Building on file:, the dynfile: prefix would address scenarios where th=
e secret file is provisioned at service startup and might not exist when =
a configuration check (bacula-* -t) is run. This is particularly relevant=
 for integration with systemd-credentials.
>
>
> Syntax: Password =3D =22dynfile:/path/to/runtime=5Fsecret=5Ffile=22
>
>
>
> Key Behavior:
>
>
> During a configuration test (bacula-* -t), if a dynfile: path does not =
exist, Bacula should issue a warning or informational message but not fai=
l the configuration check. The validity of the rest of the configuration =
can still be assessed.
>
>
>
> At actual runtime, if the dynfile: path doesn't exist when the secret i=
s needed, it would be a fatal error.
>
>
>
>
>
> Advantages:
>
>
> All benefits of file:.
>
>
>
> Crucially enables seamless integration with tools like systemd-credenti=
als (e.g., LoadCredential=3D), which make secrets available only after th=
e service unit starts processing but before the main daemon fully initial=
izes.
>
>
>
> Useful for any custom startup script that generates/places a temporary =
secret file.
>
>
>
>
>
>
> 3. The syscred: Directive (Direct systemd-credentials Integration)
>
>
> =46or a more streamlined systemd integration, a dedicated prefix could =
simplify configuration since the path used by systemd for =24CREDENTIALS=5F=
DIRECTORY is not guaranteed to remain the same between systems or systemd=
 versions. While there might be a natural reluctance to add code specific=
 to one OS's init system/credential manager, the prevalence of systemd on=
 Linux platforms and the relative ease of implementing this specific inte=
gration could offer a significant =22bang for the buck=22 for a large por=
tion of the user base.
>
>
> Syntax: Password =3D =22syscred:credential=5Fname=22 (e.g., syscred:bac=
ula=5Fdb=5Fpassword)
>
>
>
> Behavior:
>
>
> Bacula reads the =24CREDENTIALS=5FDIRECTORY environment variable (set b=
y systemd).
>
>
>
> It constructs the full path: =24CREDENTIALS=5FDIRECTORY/credential=5Fna=
me.
>
>
>
> It attempts to read the secret from this path.
>
>
>
> It inherits the =22don't fail early=22 logic from dynfile: for configur=
ation checks (if =24CREDENTIALS=5FDIRECTORY isn't set or the path doesn't=
 yet exist during -t).
>
>
>
>
>
> Advantages:
>
>
> Simplifies configuration for users on systemd: they only need the crede=
ntial name, not the full runtime path.
>
>
>
> More robust as it adapts to the actual path provided by systemd via =24=
CREDENTIALS=5FDIRECTORY.
>
>
>
> Represents a relatively =22simple win=22 for a large and growing portio=
n of the Linux user base, offering a clean, secure, and modern way to han=
dle secrets.
>
>
>
> Implementation could leverage the underlying logic developed for dynfil=
e:, making it a comparatively straightforward addition.
>
>
>
>
>
>
> Applicability to TLS Keys/Passphrases:
>
>
>
> These file:, dynfile:, and syscred: mechanisms could also be extended t=
o directives like a new TLS Key Passphrase if Bacula were to support encr=
ypted TLS private keys (leveraging the linked OpenSSL library which can h=
andle decryption given a passphrase). This would be a significant securit=
y hardening step for TLS keys. TLS Key =3D =22dynfile:/path/to/key=5Fprov=
ided=5Fby=5Fsystemd=22 is also an option if systemd provides the decrypte=
d key directly.
>
>
> 4. The credstore:name:secret=5Fidentifier Directive (External Credentia=
l Store Helper)
>
>
> =46or maximum flexibility and integration with various secret managers =
(Vault, AWS Secrets Manager, Azure Key Vault, etc.) and platforms:
>
>
> Syntax:
>
>
>
> >
> > In resource: Password =3D =22credstore:myvault:database/production/db=
=5Fpassword=22
> >
> >
> >
> > New Stanza:
> >
> > Credstore =7B Name =3D =22myvault=22 Exec =3D =22/usr/local/bin/bacul=
a-secret-helper --store vault --secret %s=22 =23 Or: Exec =3D =22/usr/loc=
al/bin/fetch-from-aws --secret %s=22 Timeout =3D 5 =23 Optional timeout f=
or the helper =7D
> >
> >
> >
> >
> >
> >
> >
>
>
>
>
>
>
> Behavior:
>
>
> Bacula forks and executes the specified Exec command, substituting %s (=
or other placeholders) with the secret=5Fidentifier.
>
>
>
> The helper script/program is responsible for fetching the secret from t=
he external store and printing it to its standard output.
>
>
>
> Bacula reads the secret from the helper's stdout.
>
>
>
>
>
> Advantages:
>
>
> Extremely flexible: supports any secret manager via custom helper scrip=
ts.
>
>
>
> Platform-agnostic core mechanism (exec).
>
>
>
> Aligns with how many other enterprise tools manage externalized secrets=
.
>
>
>
>
>
> Considerations:
>
>
> Significantly more involved to implement in Bacula (process management,=
 IPC, timeout handling, error checking from helper, argument substitution=
).
>
>
>
> Potential performance implications if secrets are fetched very frequent=
ly (though caching within Bacula could mitigate this).
>
>
>
> Careful design needed for config check mode (e.g., should helpers be ex=
ecuted=3F).
>
>
>
>
>
>
>
>
>
> Discussion Points:
>
>
> Is there general interest in these types of enhancements, understanding=
 they would be optional additions=3F
>
>
>
>
>
>
>
> Would the proposed file: directive be a welcome foundational feature=3F=

>
>
>
> =46ollowing that, would dynfile: (with its specific config-check behavi=
or) be a good next step=3F
>
>
>
> Given its potential ease of implementation and wide user base on system=
d, is syscred: a desirable simplification, despite being OS-specific=3F
>
>
>
> Is the more comprehensive credstore:exec: model something the community=
 sees a long-term need for, despite the implementation effort=3F
>
>
>
> Are there other approaches or considerations I might have missed=3F
>
>
>
>
> I believe even the simpler dynfile: and syscred: options would offer su=
bstantial benefits to many Bacula users by improving security and managea=
bility without impacting existing setups. The credstore: approach provide=
s a path for even more advanced integrations.
>
>
> Looking forward to your thoughts and feedback.
>
>
> Thanks,
>
>
> Clinton Bunch
>
>
> =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F
> Bacula-devel mailing list
> Bacula-devel=40lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bacula-devel

--685c5958_d9a50ed_9034
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<html xmlns=3D=22http://www.w3.org/1999/xhtml=22><head> <title></title> <=
meta name=3D=22viewport=22 content=3D=22width=3Ddevice-width, initial-sca=
le=3D1.0, user-scalable=3Dno=22> </head> <body style=3D=22font-family:Hel=
vetica;color:=23000000;font-size:13px;=22 dir=3D=22auto=22><div id=3D=22C=
anaryBody=22> <div> Hi,</div><div><br></div><div>what you do in bigger de=
ployments with a few hundred fd. You want change a few hundred different =
password or do you have the same password on all fd=3F=C2=A0</div><div><b=
r></div><div>When your proposed password rotation does not work on a clie=
nt what would be your solution=3FBackup fail=3F</div><div><br></div><div>=
Also to make a dependancy of your Backup system to any 3rd part software =
is really a bad idea. In case of a disaster restore and your vault is gon=
e what you will do=3F</div><div><br></div><div>Regards</div><div>Reiner</=
div> <div><br></div> </div> <div id=3D=22CanarySig=22 style=3D=22left: 0p=
x;=22><div><div><br></div></div></div> <div id=3D=22CanaryDropbox=22> </d=
iv> <blockquote id=3D=22CanaryBlockquote=22> <div> <div>On Mittwoch, Juni=
 25, 2025 at 9:06 PM, Clinton Bunch &lt;<a href=3D=22mailto:lists+bacula=40=
clintonbunch.name=22>lists+bacula=40clintonbunch.name</a>&gt; wrote:<br><=
/div> <div> <p><span =5Fngcontent-ng-c233927227=3D=22=22 class=3D=22route=
r-outlet-wrapper ng-tns-c233927227-0=22> </span></p><p =5Fngcontent-ng-c4=
063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c=
4063671643=3D=22=22 class=3D=22ng-star-inserted=22>Hello Bacula Developer=
s and Community,</span></p> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=
=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 clas=
s=3D=22ng-star-inserted=22>I'd like to initiate a discussion around enhan=
cing how Bacula manages sensitive information like passwords and potentia=
lly TLS key passphrases, moving them out of the main configuration files.=
 This aims to improve security, simplify secret rotation, and make Bacula=
 configurations more friendly for version control and modern deployment p=
ractices (e.g., with Ansible, Puppet, systemd). </span><span =5Fngcontent=
-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngconten=
t-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>Importantly, the=
se proposed enhancements would be entirely optional, ensuring no breakage=
 for existing configurations.</span></span></p> <p =5Fngcontent-ng-c40636=
71643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c4063=
671643=3D=22=22 class=3D=22ng-star-inserted=22>Currently, passwords are o=
ften embedded directly in </span><span =5Fngcontent-ng-c4063671643=3D=22=22=
 class=3D=22inline-code ng-star-inserted=22>bacula-*.conf</span><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> files. =
This has several drawbacks:</span></p> <ul =5Fngcontent-ng-c4063671643=3D=
=22=22 class=3D=22ng-star-inserted=22> <li =5Fngcontent-ng-c4063671643=3D=
=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=
=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=
=22 class=3D=22ng-star-inserted=22>Exposes secrets if the main config fil=
es are inadvertently shared or checked into version control without prote=
ction.</span></p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=
=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22>Makes secret rotation more error-prone as it requires=
 editing the main config.</span></p> </li> <li =5Fngcontent-ng-c406367164=
3=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=
=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c406367164=
3=3D=22=22 class=3D=22ng-star-inserted=22>Complicates management with con=
figuration automation tools that might handle secrets separately.</span><=
/p> </li> </ul> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-sta=
r-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-st=
ar-inserted=22>I propose a few layered approaches to address this, rangin=
g from simpler to more comprehensive:</span></p> <p =5Fngcontent-ng-c4063=
671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c233=
927227=3D=22=22 class=3D=22router-outlet-wrapper ng-tns-c233927227-0=22> =
</span></p><p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-ins=
erted=22><strong =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-=
inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star=
-inserted=22>1. The </span><span =5Fngcontent-ng-c4063671643=3D=22=22 cla=
ss=3D=22inline-code ng-star-inserted=22>file:</span><span =5Fngcontent-ng=
-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> Directive</span></s=
trong><span =5Fngcontent-ng-c233927227=3D=22=22 class=3D=22router-outlet-=
wrapper ng-tns-c233927227-0=22> </span></p><p =5Fngcontent-ng-c4063671643=
=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c233927227=
=3D=22=22 class=3D=22router-outlet-wrapper ng-tns-c233927227-0=22> </span=
></p><p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
>Many users might want to separate files for secrets and pointing to them=
 with restrictive permissions, which is good practice. A </span><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-inserted=
=22>Password =3D <a class=3D=22moz-txt-link-rfc2396E=22 href=3D=22file:/p=
ath/to/secret=22>=22file:/path/to/secret=22</a></span><span =5Fngcontent-=
ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> directive that si=
mply reads the first line of a file (stripping any trailing newline) woul=
d be a foundational improvement.</span></p> <p></p> <ul =5Fngcontent-ng-c=
4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <li =5Fngcontent-ng-c=
4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c4=
063671643=3D=22=22 class=3D=22ng-star-inserted=22><strong =5Fngcontent-ng=
-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-n=
g-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>Advantages</span></=
strong><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inse=
rted=22>:</span></p> <ul =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22n=
g-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22>Allows separation of secrets from main configuration.=
</span></p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-=
star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-s=
tar-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-=
star-inserted=22>Easier secret rotation (update file, reload Bacula).</sp=
an></p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star=
-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-=
inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star=
-inserted=22>Configuration files become safer for version control (secret=
 files are gitignored/managed separately).</span></p> </li> <li =5Fngcont=
ent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fngconte=
nt-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcont=
ent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>Aligns well wi=
th configuration management tools (e.g., Ansible can deploy the main conf=
ig and then deploy the secret file with strict permissions and content fr=
om a vault).</span></p> </li> </ul> </li> </ul> <p></p> <p =5Fngcontent-n=
g-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><strong =5Fngconten=
t-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngconte=
nt-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>2. The </span><=
span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-=
inserted=22>dynfile:</span><span =5Fngcontent-ng-c4063671643=3D=22=22 cla=
ss=3D=22ng-star-inserted=22> Directive (Dynamic/Deferred =46ile Loading)<=
/span></strong><span =5Fngcontent-ng-c233927227=3D=22=22 class=3D=22route=
r-outlet-wrapper ng-tns-c233927227-0=22> </span></p><p =5Fngcontent-ng-c4=
063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c=
4063671643=3D=22=22 class=3D=22ng-star-inserted=22>Building on </span><sp=
an =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-in=
serted=22>file:</span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=
=22ng-star-inserted=22>, the </span><span =5Fngcontent-ng-c4063671643=3D=22=
=22 class=3D=22inline-code ng-star-inserted=22>dynfile:</span><span =5Fng=
content-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> prefix wo=
uld address scenarios where the secret file is provisioned at service sta=
rtup and might not exist when a configuration check (</span><span =5Fngco=
ntent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-inserted=22>=
bacula-* -t</span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22n=
g-star-inserted=22>) is run. This is particularly relevant for integratio=
n with </span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22inlin=
e-code ng-star-inserted=22>systemd-credentials</span><span =5Fngcontent-n=
g-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>.</span></p> <ul =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <li =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fn=
gcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><strong =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>Syntax</=
span></strong><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-st=
ar-inserted=22>: </span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=
=22inline-code ng-star-inserted=22>Password =3D =22dynfile:/path/to/runti=
me=5Fsecret=5Ffile=22</span></p> </li> <li =5Fngcontent-ng-c4063671643=3D=
=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=
=22 class=3D=22ng-star-inserted=22><strong =5Fngcontent-ng-c4063671643=3D=
=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=
=22=22 class=3D=22ng-star-inserted=22>Key Behavior</span></strong><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>:</span>=
</p> <ul =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=
=22> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=
=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
>During a configuration test (</span><span =5Fngcontent-ng-c4063671643=3D=
=22=22 class=3D=22inline-code ng-star-inserted=22>bacula-* -t</span><span=
 =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>), i=
f a </span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-c=
ode ng-star-inserted=22>dynfile:</span><span =5Fngcontent-ng-c4063671643=3D=
=22=22 class=3D=22ng-star-inserted=22> path does not exist, Bacula should=
 issue a warning or informational message but </span><strong =5Fngcontent=
-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngconten=
t-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>not fail the con=
figuration check</span></strong><span =5Fngcontent-ng-c4063671643=3D=22=22=
 class=3D=22ng-star-inserted=22>. The validity of the rest of the configu=
ration can still be assessed.</span></p> </li> <li =5Fngcontent-ng-c40636=
71643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c406367=
1643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c40636=
71643=3D=22=22 class=3D=22ng-star-inserted=22>At actual runtime, if the <=
/span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code n=
g-star-inserted=22>dynfile:</span><span =5Fngcontent-ng-c4063671643=3D=22=
=22 class=3D=22ng-star-inserted=22> path doesn't exist when the secret is=
 needed, it would be a fatal error.</span></p> </li> </ul> </li> <li =5Fn=
gcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fng=
content-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><strong =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>Advantag=
es</span></strong><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22n=
g-star-inserted=22>:</span></p> <ul =5Fngcontent-ng-c4063671643=3D=22=22 =
class=3D=22ng-star-inserted=22> <li =5Fngcontent-ng-c4063671643=3D=22=22 =
class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 c=
lass=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 =
class=3D=22ng-star-inserted=22>All benefits of </span><span =5Fngcontent-=
ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-inserted=22>file:<=
/span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inser=
ted=22>.</span></p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=
=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22>Crucially enables seamless integration with tools lik=
e </span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-cod=
e ng-star-inserted=22>systemd-credentials</span><span =5Fngcontent-ng-c40=
63671643=3D=22=22 class=3D=22ng-star-inserted=22> (e.g., </span><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-inserted=
=22>LoadCredential=3D</span><span =5Fngcontent-ng-c4063671643=3D=22=22 cl=
ass=3D=22ng-star-inserted=22>), which make secrets available only after t=
he service unit starts processing but before the main daemon fully initia=
lizes.</span></p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=
=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22>Useful for any custom startup script that generates/p=
laces a temporary secret file.</span></p> </li> </ul> </li> </ul> <p></p>=
 <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><=
strong =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
>3. The </span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22inli=
ne-code ng-star-inserted=22>syscred:</span><span =5Fngcontent-ng-c4063671=
643=3D=22=22 class=3D=22ng-star-inserted=22> Directive (Direct systemd-cr=
edentials Integration)</span></strong></p> <p =5Fngcontent-ng-c4063671643=
=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c406367164=
3=3D=22=22 class=3D=22ng-star-inserted=22>=46or a more streamlined system=
d integration, a dedicated prefix could simplify configuration=C2=A0</spa=
n><span =5Fngcontent-ng-c233927227=3D=22=22 class=3D=22router-outlet-wrap=
per ng-tns-c233927227-0=22><span =5Fngcontent-ng-c4063671643=3D=22=22 cla=
ss=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 cl=
ass=3D=22ng-star-inserted=22>since the path used by systemd for </span><s=
pan =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-i=
nserted=22>=24CREDENTIALS=5FDIRECTORY</span><span =5Fngcontent-ng-c406367=
1643=3D=22=22 class=3D=22ng-star-inserted=22> is not guaranteed to remain=
 the same between systems or systemd versions.</span></span></span><span =
=5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> </sp=
an><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=
=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserte=
d=22>While there might be a natural reluctance to add code specific to on=
e OS's init system/credential manager, the prevalence of systemd on Linux=
 platforms and the relative ease of implementing this specific integratio=
n could offer a significant =22bang for the buck=22 for a large portion o=
f the user base.</span></span></p> <ul =5Fngcontent-ng-c4063671643=3D=22=22=
 class=3D=22ng-star-inserted=22> <li =5Fngcontent-ng-c4063671643=3D=22=22=
 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 =
class=3D=22ng-star-inserted=22><strong =5Fngcontent-ng-c4063671643=3D=22=22=
 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22=
 class=3D=22ng-star-inserted=22>Syntax</span></strong><span =5Fngcontent-=
ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>: </span><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-inserted=
=22>Password =3D =22syscred:credential=5Fname=22</span><span =5Fngcontent=
-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> (e.g., </span><s=
pan =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-i=
nserted=22>syscred:bacula=5Fdb=5Fpassword</span><span =5Fngcontent-ng-c40=
63671643=3D=22=22 class=3D=22ng-star-inserted=22>)</span></p> </li> <li =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fn=
gcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><strong =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>Behavior=
</span></strong><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-=
star-inserted=22>:</span></p> <ul =5Fngcontent-ng-c4063671643=3D=22=22 cl=
ass=3D=22ng-star-inserted=22> <li =5Fngcontent-ng-c4063671643=3D=22=22 cl=
ass=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 cla=
ss=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 cl=
ass=3D=22ng-star-inserted=22>Bacula reads the </span><span =5Fngcontent-n=
g-c4063671643=3D=22=22 class=3D=22inline-code ng-star-inserted=22>=24CRED=
ENTIALS=5FDIRECTORY</span><span =5Fngcontent-ng-c4063671643=3D=22=22 clas=
s=3D=22ng-star-inserted=22> environment variable (set by systemd).</span>=
</p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-in=
serted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-ins=
erted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-in=
serted=22>It constructs the full path: </span><span =5Fngcontent-ng-c4063=
671643=3D=22=22 class=3D=22inline-code ng-star-inserted=22>=24CREDENTIALS=
=5FDIRECTORY/credential=5Fname</span><span =5Fngcontent-ng-c4063671643=3D=
=22=22 class=3D=22ng-star-inserted=22>.</span></p> </li> <li =5Fngcontent=
-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcontent-=
ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent=
-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>It attempts to re=
ad the secret from this path.</span></p> </li> <li =5Fngcontent-ng-c40636=
71643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c406367=
1643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c40636=
71643=3D=22=22 class=3D=22ng-star-inserted=22>It inherits the =22don't fa=
il early=22 logic from </span><span =5Fngcontent-ng-c4063671643=3D=22=22 =
class=3D=22inline-code ng-star-inserted=22>dynfile:</span><span =5Fngcont=
ent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> for configura=
tion checks (if </span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=
=22inline-code ng-star-inserted=22>=24CREDENTIALS=5FDIRECTORY</span><span=
 =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> isn=
't set or the path doesn't yet exist during </span><span =5Fngcontent-ng-=
c4063671643=3D=22=22 class=3D=22inline-code ng-star-inserted=22>-t</span>=
<span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
>).</span></p> </li> </ul> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22=
 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 =
class=3D=22ng-star-inserted=22><strong =5Fngcontent-ng-c4063671643=3D=22=22=
 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22=
 class=3D=22ng-star-inserted=22>Advantages</span></strong><span =5Fngcont=
ent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>:</span></p> <=
ul =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <=
li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <=
p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><sp=
an =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>Si=
mplifies configuration for users on systemd: they only need the credentia=
l name, not the full runtime path.</span></p> </li> <li =5Fngcontent-ng-c=
4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c4=
063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c=
4063671643=3D=22=22 class=3D=22ng-star-inserted=22>More robust as it adap=
ts to the actual path provided by systemd via </span><span =5Fngcontent-n=
g-c4063671643=3D=22=22 class=3D=22inline-code ng-star-inserted=22>=24CRED=
ENTIALS=5FDIRECTORY</span><span =5Fngcontent-ng-c4063671643=3D=22=22 clas=
s=3D=22ng-star-inserted=22>.</span></p> </li> <li =5Fngcontent-ng-c406367=
1643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671=
643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c406367=
1643=3D=22=22 class=3D=22ng-star-inserted=22>Represents a relatively =22s=
imple win=22 for a large and growing portion of the Linux user base, offe=
ring a clean, secure, and modern way to handle secrets.</span></p> </li> =
<li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> =
<p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><s=
pan =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>I=
mplementation could leverage the underlying logic developed for </span><s=
pan =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-i=
nserted=22>dynfile:</span><span =5Fngcontent-ng-c4063671643=3D=22=22 clas=
s=3D=22ng-star-inserted=22>, making it a comparatively straightforward ad=
dition.</span></p> </li> </ul> </li> </ul> <p =5Fngcontent-ng-c4063671643=
=3D=22=22 class=3D=22ng-star-inserted=22><strong =5Fngcontent-ng-c4063671=
643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c406367=
1643=3D=22=22 class=3D=22ng-star-inserted=22>Applicability to TLS Keys/Pa=
ssphrases:</span></strong><span =5Fngcontent-ng-c233927227=3D=22=22 class=
=3D=22router-outlet-wrapper ng-tns-c233927227-0=22><span =5Fngcontent-ng-=
c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><br> </span></span></=
p> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
><span =5Fngcontent-ng-c233927227=3D=22=22 class=3D=22router-outlet-wrapp=
er ng-tns-c233927227-0=22><span =5Fngcontent-ng-c4063671643=3D=22=22 clas=
s=3D=22ng-star-inserted=22>These </span><span =5Fngcontent-ng-c4063671643=
=3D=22=22 class=3D=22inline-code ng-star-inserted=22>file:</span><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>, </span=
><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-sta=
r-inserted=22>dynfile:</span><span =5Fngcontent-ng-c4063671643=3D=22=22 c=
lass=3D=22ng-star-inserted=22>, and </span><span =5Fngcontent-ng-c4063671=
643=3D=22=22 class=3D=22inline-code ng-star-inserted=22>syscred:</span><s=
pan =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> =
mechanisms could also be extended to directives like a new </span><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-inserted=
=22>TLS Key Passphrase</span><span =5Fngcontent-ng-c4063671643=3D=22=22 c=
lass=3D=22ng-star-inserted=22> if Bacula were to support encrypted TLS pr=
ivate keys (leveraging the linked OpenSSL library which can handle decryp=
tion given a passphrase). This would be a significant security hardening =
step for TLS keys. </span><span =5Fngcontent-ng-c4063671643=3D=22=22 clas=
s=3D=22inline-code ng-star-inserted=22>TLS Key =3D =22dynfile:/path/to/ke=
y=5Fprovided=5Fby=5Fsystemd=22</span><span =5Fngcontent-ng-c4063671643=3D=
=22=22 class=3D=22ng-star-inserted=22> is also an option if systemd provi=
des the decrypted key directly.</span></span></p> <p =5Fngcontent-ng-c406=
3671643=3D=22=22 class=3D=22ng-star-inserted=22><strong =5Fngcontent-ng-c=
4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-=
c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>4. The </span><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-inserted=
=22>credstore:name:secret=5Fidentifier</span><span =5Fngcontent-ng-c40636=
71643=3D=22=22 class=3D=22ng-star-inserted=22> Directive (External Creden=
tial Store Helper)</span></strong><span =5Fngcontent-ng-c233927227=3D=22=22=
 class=3D=22router-outlet-wrapper ng-tns-c233927227-0=22> </span></p><p =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>=46or ma=
ximum flexibility and integration with various secret managers (Vault, AW=
S Secrets Manager, Azure Key Vault, etc.) and platforms:</span></p> <p></=
p> <p></p> <p></p> <ul> <li><span =5Fngcontent-ng-c233927227=3D=22=22 cla=
ss=3D=22router-outlet-wrapper ng-tns-c233927227-0=22> <p =5Fngcontent-ng-=
c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><strong =5Fngcontent-=
ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent=
-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>Syntax</span></st=
rong><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-insert=
ed=22>:</span></p> </span></li> </ul> <blockquote><span =5Fngcontent-ng-c=
233927227=3D=22=22 class=3D=22router-outlet-wrapper ng-tns-c233927227-0=22=
> <ul =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>=
<span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
>In resource: </span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
inline-code ng-star-inserted=22>Password =3D =22credstore:myvault:databas=
e/production/db=5Fpassword=22</span></p> </li> <li =5Fngcontent-ng-c40636=
71643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c406367=
1643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c40636=
71643=3D=22=22 class=3D=22ng-star-inserted=22>New Stanza:</span></p> <spa=
n class=3D=22mat-expansion-indicator ng-star-inserted=22></span> <div cla=
ss=3D=22mat-expansion-panel-content-wrapper=22> <div role=3D=22region=22 =
class=3D=22mat-expansion-panel-content=22 id=3D=22cdk-accordion-child-81=22=
 aria-labelledby=3D=22mat-expansion-panel-header-81=22> <div class=3D=22m=
at-expansion-panel-body=22> <div =5Fngcontent-ng-c289253575=3D=22=22 clas=
s=3D=22syntax-highlighted-code-wrapper=22> <div =5Fngcontent-ng-c28925357=
5=3D=22=22 class=3D=22syntax-highlighted-code=22> <pre =5Fngcontent-ng-c2=
89253575=3D=22=22><code =5Fngcontent-ng-c289253575=3D=22=22>Credstore =7B=
 Name =3D <span class=3D=22hljs-string=22>=22myvault=22</span> Exec =3D <=
span class=3D=22hljs-string=22>=22/usr/local/bin/bacula-secret-helper --s=
tore vault --secret %s=22</span> <span class=3D=22hljs-comment=22>=23 Or:=
 Exec =3D =22/usr/local/bin/fetch-from-aws --secret %s=22</span> Timeout =
=3D <span class=3D=22hljs-number=22>5</span> <span class=3D=22hljs-commen=
t=22>=23 Optional timeout for the helper</span> =7D</code> </pre> </div> =
</div> </div> </div> </div> </li> </ul> </span></blockquote> <p><br> </p>=
 <ul> <li><span =5Fngcontent-ng-c233927227=3D=22=22 class=3D=22router-out=
let-wrapper ng-tns-c233927227-0=22> </span></li><li =5Fngcontent-ng-c4063=
671643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c40636=
71643=3D=22=22 class=3D=22ng-star-inserted=22><strong =5Fngcontent-ng-c40=
63671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c4=
063671643=3D=22=22 class=3D=22ng-star-inserted=22>Behavior</span></strong=
><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
>:</span></p> <ul =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star=
-inserted=22> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star=
-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-=
inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star=
-inserted=22>Bacula forks and executes the specified </span><span =5Fngco=
ntent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-inserted=22>=
Exec</span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-=
inserted=22> command, substituting </span><span =5Fngcontent-ng-c40636716=
43=3D=22=22 class=3D=22inline-code ng-star-inserted=22>%s</span><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> (or oth=
er placeholders) with the </span><span =5Fngcontent-ng-c4063671643=3D=22=22=
 class=3D=22inline-code ng-star-inserted=22>secret=5Fidentifier</span><sp=
an =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>.<=
/span></p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-s=
tar-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-st=
ar-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-s=
tar-inserted=22>The helper script/program is responsible for fetching the=
 secret from the external store and printing it to its standard output.</=
span></p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-st=
ar-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-sta=
r-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-st=
ar-inserted=22>Bacula reads the secret from the helper's stdout.</span></=
p> </li> </ul> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22n=
g-star-inserted=22><strong =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22>Advantages</span></strong><span =5Fngcontent-ng-c4063=
671643=3D=22=22 class=3D=22ng-star-inserted=22>:</span></p> <ul =5Fngcont=
ent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <li =5Fngcont=
ent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fngconte=
nt-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcont=
ent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>Extremely flex=
ible: supports any secret manager via custom helper scripts.</span></p> <=
/li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=
=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
>Platform-agnostic core mechanism (</span><span =5Fngcontent-ng-c40636716=
43=3D=22=22 class=3D=22inline-code ng-star-inserted=22>exec</span><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>).</span=
></p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-i=
nserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-in=
serted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-i=
nserted=22>Aligns with how many other enterprise tools manage externalize=
d secrets.</span></p> </li> </ul> </li> <li =5Fngcontent-ng-c4063671643=3D=
=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=
=22 class=3D=22ng-star-inserted=22><strong =5Fngcontent-ng-c4063671643=3D=
=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=
=22=22 class=3D=22ng-star-inserted=22>Considerations</span></strong><span=
 =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>:</s=
pan></p> <ul =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inse=
rted=22> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inse=
rted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inser=
ted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inse=
rted=22>Significantly more involved to implement in Bacula (process manag=
ement, IPC, timeout handling, error checking from helper, argument substi=
tution).</span></p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=
=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22>Potential performance implications if secrets are fet=
ched very frequently (though caching within Bacula could mitigate this).<=
/span></p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-s=
tar-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-st=
ar-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-s=
tar-inserted=22>Careful design needed for config check mode (e.g., should=
 helpers be executed=3F).</span></p> </li> </ul> </li> </ul> <p><span =5F=
ngcontent-ng-c233927227=3D=22=22 class=3D=22router-outlet-wrapper ng-tns-=
c233927227-0=22> </span></p><p =5Fngcontent-ng-c4063671643=3D=22=22 class=
=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c233927227=3D=22=22 class=
=3D=22router-outlet-wrapper ng-tns-c233927227-0=22> </span></p><p =5Fngco=
ntent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><strong =5Fn=
gcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>Discussi=
on Points:</span></strong></p> <ul =5Fngcontent-ng-c4063671643=3D=22=22 c=
lass=3D=22ng-star-inserted=22> <li =5Fngcontent-ng-c4063671643=3D=22=22 c=
lass=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 cl=
ass=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 c=
lass=3D=22ng-star-inserted=22>Is there general interest in these types of=
 enhancements, understanding they would be optional additions=3F</span></=
p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inse=
rted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inser=
ted=22><span =5Fngcontent-ng-c233927227=3D=22=22 class=3D=22router-outlet=
-wrapper ng-tns-c233927227-0=22> </span></p></li><li =5Fngcontent-ng-c406=
3671643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcontent-ng-c4063=
671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c406=
3671643=3D=22=22 class=3D=22ng-star-inserted=22>Would the proposed </span=
><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-sta=
r-inserted=22>file:</span><span =5Fngcontent-ng-c4063671643=3D=22=22 clas=
s=3D=22ng-star-inserted=22> directive be a welcome foundational feature=3F=
</span></p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-=
star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-s=
tar-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-=
star-inserted=22>=46ollowing that, would </span><span =5Fngcontent-ng-c40=
63671643=3D=22=22 class=3D=22inline-code ng-star-inserted=22>dynfile:</sp=
an><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=
=22> (with its specific config-check behavior) be a good next step=3F</sp=
an></p> </li> <p></p> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22n=
g-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22>Given its potential ease of implementation and wide u=
ser base on systemd, is </span><span =5Fngcontent-ng-c4063671643=3D=22=22=
 class=3D=22inline-code ng-star-inserted=22>syscred:</span><span =5Fngcon=
tent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> a desirable =
simplification, despite being OS-specific=3F</span></p> </li> <li =5Fngco=
ntent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> <p =5Fngcon=
tent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22><span =5Fngco=
ntent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22>Is the more =
comprehensive </span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
inline-code ng-star-inserted=22>credstore:exec:</span><span =5Fngcontent-=
ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> model something t=
he community sees a long-term need for, despite the implementation effort=
=3F</span></p> </li> <li =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22n=
g-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22>Are there other approaches or considerations I might =
have missed=3F</span></p> </li> </ul> <p =5Fngcontent-ng-c4063671643=3D=22=
=22 class=3D=22ng-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=
=22 class=3D=22ng-star-inserted=22>I believe even the simpler </span><spa=
n =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-ins=
erted=22>dynfile:</span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=
=22ng-star-inserted=22> and </span><span =5Fngcontent-ng-c4063671643=3D=22=
=22 class=3D=22inline-code ng-star-inserted=22>syscred:</span><span =5Fng=
content-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22> options w=
ould offer substantial benefits to many Bacula users by improving securit=
y and manageability without impacting existing setups. The </span><span =5F=
ngcontent-ng-c4063671643=3D=22=22 class=3D=22inline-code ng-star-inserted=
=22>credstore:</span><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22> approach provides a path for even more advanced inte=
grations.</span></p> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22n=
g-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22=
ng-star-inserted=22>Looking forward to your thoughts and feedback.</span>=
</p> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng-star-inserted=22=
>Thanks,</span></p> <p =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22ng=
-star-inserted=22><span =5Fngcontent-ng-c4063671643=3D=22=22 class=3D=22n=
g-star-inserted=22>Clinton Bunch<br> </span><span =5Fngcontent-ng-c406367=
1643=3D=22=22 class=3D=22ng-star-inserted=22></span></p> <p></p> <p></p> =
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F <br>Ba=
cula-devel mailing list <br>Bacula-devel=40lists.sourceforge.net <br>http=
s://lists.sourceforge.net/lists/listinfo/bacula-devel <br></div> </div> <=
/blockquote> </body></html>
--685c5958_d9a50ed_9034--

--685c5958_20daabd1_9034
Content-Type: application/pgp-signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: Canary PGP V3

iGYEABEKACYfHFJlaW5lciBKdW5nIDxyLmp1bmdAbXRpZXIub3JnPgUCaFxZWAAK
CRCLzO9FSH44truHAJoCUhoM+4pLTjoY5wOIeJVyYRwwnwCePV6zThdmM2ZiLcZk
nQQ6QTHRyn8=
=Es2n
-----END PGP SIGNATURE-----

--685c5958_20daabd1_9034--



--===============7380854268427786401==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============7380854268427786401==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Bacula-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bacula-devel

--===============7380854268427786401==--