Re: Proposal: Enhancing Bacula Secret Management - file:, dynfile:, syscred:, and credstore:
Clinton Bunch <[email protected]> Wed, 25 Jun 2025 17:36:11 -0500
| Newsgroups | gmane.comp.sysutils.backup.bacula.devel |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============7306853595275334604== Content-Type: multipart/alternative; boundary="------------iqXJ3YnuwNPOqX65r0FD4JNh" Content-Language: en-US This is a multi-part message in MIME format. --------------iqXJ3YnuwNPOqX65r0FD4JNh Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable Now if you have a few hundred fd, you face the same choice, only now you=20 have to edit your configuration file on your director as well as each=20 file daemon if you want to rotate your passwords. Password rotation would be entirely up to the admin as it is now, it=20 would just be simpler. Restoring your vault in a disaster, would be about as difficult as=20 restoring your catalog.=C2=A0 You have a plan for that, don't you? It sho= uld=20 be a minor addition to your disaster recovery plan. That assumes you=20 self-host your vault.=C2=A0 There are several cloud services. Nor would my proposal force you to use a secrets manager, you're free to=20 keep your passwords in your unversioned config files readable by anyone=20 with root access to your server. On 6/25/2025 3:17 PM, Reiner Jung wrote: > Hi, > > what you do in bigger deployments with a few hundred fd. You want=20 > change a few hundred different password or do you have the same=20 > password on all fd? > > When your proposed password rotation does not work on a client what=20 > would be your solution?Backup fail? > > Also to make a dependancy of your Backup system to any 3rd part=20 > software is really a bad idea. In case of a disaster restore and your=20 > vault is gone what you will do? > > Regards > Reiner > > > On Mittwoch, Juni 25, 2025 at 9:06 PM, Clinton Bunch > <[email protected]> wrote: > > Hello Bacula Developers and Community, > > I'd like to initiate a discussion around enhancing how Bacula > manages sensitive information like passwords and potentially TLS > key passphrases, moving them out of the main configuration files. > This aims to improve security, simplify secret rotation, and make > Bacula configurations more friendly for version control and modern > deployment practices (e.g., with Ansible, Puppet, systemd). > Importantly, these proposed enhancements would be entirely > optional, ensuring no breakage for existing configurations. > > Currently, passwords are often embedded directly in > bacula-*.conffiles. This has several drawbacks: > > * > > Exposes secrets if the main config files are inadvertently > shared or checked into version control without protection. > > * > > Makes secret rotation more error-prone as it requires editing > the main config. > > * > > Complicates management with configuration automation tools > that might handle secrets separately. > > I propose a few layered approaches to address this, ranging from > simpler to more comprehensive: > > *1. The file:Directive* > > Many users might want to separate files for secrets and pointing > to them with restrictive permissions, which is good practice. A > Password =3D "file:/path/to/secret"directive that simply reads the > first line of a file (stripping any trailing newline) would be a > foundational improvement. > > * > > *Advantages*: > > o > > Allows separation of secrets from main configuration. > > o > > Easier secret rotation (update file, reload Bacula). > > o > > Configuration files become safer for version control > (secret files are gitignored/managed separately). > > o > > Aligns well with configuration management tools (e.g., > Ansible can deploy the main config and then deploy the > secret file with strict permissions and content from a vaul= t). > > *2. The dynfile:Directive (Dynamic/Deferred File Loading)* > > Building on file:, the dynfile:prefix would address scenarios > where the secret file is provisioned at service startup and might > not exist when a configuration check (bacula-* -t) is run. This is > particularly relevant for integration with systemd-credentials. > > * > > *Syntax*: Password =3D "dynfile:/path/to/runtime_secret_file" > > * > > *Key Behavior*: > > o > > During a configuration test (bacula-* -t), if a > dynfile:path does not exist, Bacula should issue a warning > or informational message but *not fail the configuration > check*. The validity of the rest of the configuration can > still be assessed. > > o > > At actual runtime, if the dynfile:path doesn't exist when > the secret is needed, it would be a fatal error. > > * > > *Advantages*: > > o > > All benefits of file:. > > o > > Crucially enables seamless integration with tools like > systemd-credentials(e.g., LoadCredential=3D), which make > secrets available only after the service unit starts > processing but before the main daemon fully initializes. > > o > > Useful for any custom startup script that generates/places > a temporary secret file. > > *3. The syscred:Directive (Direct systemd-credentials Integration)* > > For a more streamlined systemd integration, a dedicated prefix > could simplify configuration since the path used by systemd for > $CREDENTIALS_DIRECTORYis not guaranteed to remain the same between > systems or systemd versions.While there might be a natural > reluctance to add code specific to one OS's init system/credential > manager, the prevalence of systemd on Linux platforms and the > relative ease of implementing this specific integration could > offer a significant "bang for the buck" for a large portion of the > user base. > > * > > *Syntax*: Password =3D "syscred:credential_name"(e.g., > syscred:bacula_db_password) > > * > > *Behavior*: > > o > > Bacula reads the $CREDENTIALS_DIRECTORYenvironment > variable (set by systemd). > > o > > It constructs the full path: > $CREDENTIALS_DIRECTORY/credential_name. > > o > > It attempts to read the secret from this path. > > o > > It inherits the "don't fail early" logic from dynfile:for > configuration checks (if $CREDENTIALS_DIRECTORYisn't set > or the path doesn't yet exist during -t). > > * > > *Advantages*: > > o > > Simplifies configuration for users on systemd: they only > need the credential name, not the full runtime path. > > o > > More robust as it adapts to the actual path provided by > systemd via $CREDENTIALS_DIRECTORY. > > o > > Represents a relatively "simple win" for a large and > growing portion of the Linux user base, offering a clean, > secure, and modern way to handle secrets. > > o > > Implementation could leverage the underlying logic > developed for dynfile:, making it a comparatively > straightforward addition. > > *Applicability to TLS Keys/Passphrases:* > > These file:, dynfile:, and syscred:mechanisms could also be > extended to directives like a new TLS Key Passphraseif Bacula were > to support encrypted TLS private keys (leveraging the linked > OpenSSL library which can handle decryption given a passphrase). > This would be a significant security hardening step for TLS keys. > TLS Key =3D "dynfile:/path/to/key_provided_by_systemd"is also an > option if systemd provides the decrypted key directly. > > *4. The credstore:name:secret_identifierDirective (External > Credential Store Helper)* > > For maximum flexibility and integration with various secret > managers (Vault, AWS Secrets Manager, Azure Key Vault, etc.) and > platforms: > > * > > *Syntax*: > > * > > In resource: Password =3D > "credstore:myvault:database/production/db_password" > > * > > New Stanza: > > |Credstore { Name =3D "myvault" Exec =3D > "/usr/local/bin/bacula-secret-helper --store vault > --secret %s" # Or: Exec =3D "/usr/local/bin/fetch-from-aws > --secret %s" Timeout =3D 5 # Optional timeout for the helpe= r }|=20 > > > * > > > > * > > *Behavior*: > > o > > Bacula forks and executes the specified Execcommand, > substituting %s(or other placeholders) with the > secret_identifier. > > o > > The helper script/program is responsible for fetching the > secret from the external store and printing it to its > standard output. > > o > > Bacula reads the secret from the helper's stdout. > > * > > *Advantages*: > > o > > Extremely flexible: supports any secret manager via custom > helper scripts. > > o > > Platform-agnostic core mechanism (exec). > > o > > Aligns with how many other enterprise tools manage > externalized secrets. > > * > > *Considerations*: > > o > > Significantly more involved to implement in Bacula > (process management, IPC, timeout handling, error checking > from helper, argument substitution). > > o > > Potential performance implications if secrets are fetched > very frequently (though caching within Bacula could > mitigate this). > > o > > Careful design needed for config check mode (e.g., should > helpers be executed?). > > *Discussion Points:* > > * > > Is there general interest in these types of enhancements, > understanding they would be optional additions? > > * > > > * > > Would the proposed file:directive be a welcome foundational > feature? > > * > > Following that, would dynfile:(with its specific config-check > behavior) be a good next step? > > * > > Given its potential ease of implementation and wide user base > on systemd, is syscred:a desirable simplification, despite > being OS-specific? > > * > > Is the more comprehensive credstore:exec:model something the > community sees a long-term need for, despite the > implementation effort? > > * > > Are there other approaches or considerations I might have misse= d? > > I believe even the simpler dynfile:and syscred:options would offer > substantial benefits to many Bacula users by improving security > and manageability without impacting existing setups. The > credstore:approach provides a path for even more advanced > integrations. > > Looking forward to your thoughts and feedback. > > Thanks, > > Clinton Bunch > > _______________________________________________ > Bacula-devel mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/bacula-devel > --------------iqXJ3YnuwNPOqX65r0FD4JNh Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <!DOCTYPE html> <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF= -8"> </head> <body> <p>Now if you have a few hundred fd, you face the same choice, only now you have to edit your configuration file on your director as well as each file daemon if you want to rotate your passwords.=C2=A0= <br> </p> <p>Password rotation would be entirely up to the admin as it is now, it would just be simpler.</p> <p>Restoring your vault in a disaster, would be about as difficult as restoring your catalog.=C2=A0 You have a plan for that, don't yo= u?=C2=A0 It should be a minor addition to your disaster recovery plan.=C2=A0 That assumes you self-host your vault.=C2=A0 There are several clou= d services.</p> <p>Nor would my proposal force you to use a secrets manager, you're free to keep your passwords in your unversioned config files readable by anyone with root access to your server.<br> </p> <div class=3D"moz-cite-prefix">On 6/25/2025 3:17 PM, Reiner Jung wrote:<br> </div> <blockquote type=3D"cite" cite=3D"mid:9d08c4f7-cd92-44f8-ad2b-39fb2be921d2@Canary"> <meta http-equiv=3D"content-type" content=3D"text/html; charset=3DU= TF-8"> <title></title> <meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=3D1.0, user-scalable=3Dno"= > <div id=3D"CanaryBody"> <div> Hi,</div> <div><br> </div> <div>what you do in bigger deployments with a few hundred fd. You want change a few hundred different password or do you have the same password on all fd?=C2=A0</div> <div><br> </div> <div>When your proposed password rotation does not work on a client what would be your solution?Backup fail?</div> <div><br> </div> <div>Also to make a dependancy of your Backup system to any 3rd part software is really a bad idea. In case of a disaster restore and your vault is gone what you will do?</div> <div><br> </div> <div>Regards</div> <div>Reiner</div> <div><br> </div> </div> <div id=3D"CanarySig" style=3D"left: 0px;"> <div> <div><br> </div> </div> </div> <div id=3D"CanaryDropbox"> </div> <blockquote id=3D"CanaryBlockquote"> <div> <div>On Mittwoch, Juni 25, 2025 at 9:06 PM, Clinton Bunch <<= a href=3D"mailto:[email protected]" moz-do-not-send=3D"true" class=3D"moz-txt-link-freetext">li= [email protected]</a>> wrote:<br> </div> <div> <p><span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"> </sp= an></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >Hello Bacula Developers and Community,</span></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >I'd like to initiate a discussion around enhancing how Bacula manages sensitive information like passwords and potentially TLS key passphrases, moving them out of the main configuration files. This aims to improve security, simplify secret rotation, and make Bacula configurations more friendly for version control and modern deployment practices (e.g., with Ansible, Puppet, systemd). </span><= span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= ><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d">Importantly, these proposed enhancements would be entirely optional, ensuring no breakage for existing configurations.</span></span></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >Currently, passwords are often embedded directly in </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">bacula-*.conf</spa= n><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= > files. This has several drawbacks:</span></p> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= > <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Exposes secrets if the mai= n config files are inadvertently shared or checked into version control without protection.</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Makes secret rotation more error-prone as it requires editing the main config.</= span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Complicates management wit= h configuration automation tools that might handle secrets separately.</span></p> </li> </ul> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >I propose a few layered approaches to address this, ranging from simpler to more comprehensive:</span></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"> </sp= an></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= ><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d">1. The </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">file:</span><spa= n _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> Directive</span></strong><span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"> </sp= an></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"> </sp= an></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >Many users might want to separate files for secrets and pointing to them with restrictive permissions, which is good practice. A </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">Password =3D <a class=3D"moz-txt-link-rfc2396E" href=3D"file:/path/to/secret" moz-do-not-send=3D"true">= "file:/path/to/secret"</a></span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= > directive that simply reads the first line of a file (stripping any trailing newline) would be a foundational improvement.</span></p> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= > <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Advantages</span></stron= g><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">:</span></p> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Allows separation of secrets from main configuration.</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Easier secret rotation (update file, reload Bacula).</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Configuration files become safer for version control (secret files are gitignored/managed separately).</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Aligns well with configuration management tools (e.g., Ansible can deploy the main config and then deploy the secret file with strict permissions and content from a vault).</span></p> </li> </ul> </li> </ul> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= ><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d">2. The </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">dynfile:</span><= span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> Directive (Dynamic/Deferred File Loading)</span></stron= g><span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"> </sp= an></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >Building on </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">file:</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >, the </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">dynfile:</span><sp= an _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= > prefix would address scenarios where the secret file is provisioned at service startup and might not exist when a configuration check (</span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">bacula-* -t</span>= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >) is run. This is particularly relevant for integration with </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">systemd-credential= s</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >.</span></p> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= > <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Syntax</span></strong><s= pan _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">: </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">Password =3D "dynfile:/path/to/runtime_secret_file"</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Key Behavior</span></str= ong><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">:</span></p> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">During a configuration test (</span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">bacula-* -= t</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">), if a </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">dynfile:</= span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> path does not exist, Bacula should issue a warning or informational message but </span><strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">not fail the configuration check</span></strong><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">. The validity of the rest of the configuration can still be assessed.<= /span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">At actual runtime, if the </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">dynfile:</= span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> path doesn't exist when the secret is needed, it would be a fatal error.</span></p> </li> </ul> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Advantages</span></stron= g><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">:</span></p> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">All benefits of </span= ><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">file:</spa= n><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">.</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Crucially enables seamless integration with tools like </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">systemd-cr= edentials</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> (e.g., </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">LoadCreden= tial=3D</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">), which make secrets available only after the service unit starts processing but before the main daemon fully initializes.</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Useful for any custom startup script that generates/places a temporary secret file.</span></p> </li> </ul> </li> </ul> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= ><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d">3. The </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">syscred:</span><= span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> Directive (Direct systemd-credentials Integration)</spa= n></strong></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >For a more streamlined systemd integration, a dedicated prefix could simplify configuration=C2=A0</span><span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">since the path used by systemd for </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">$CREDENTIALS_D= IRECTORY</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> is not guaranteed to remain the same between systems or systemd versions.<= /span></span></span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= > </span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= ><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d">While there might be a natural reluctance to add code specific to one OS's init system/credential manager, the prevalence of systemd on Linux platforms and the relative ease of implementing this specific integration could offer a significant "bang for the buck" for a large portion of the user base.</span></spa= n></p> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= > <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Syntax</span></strong><s= pan _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">: </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">Password =3D "syscred:credential_name"</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> (e.g., </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">syscred:bacula= _db_password</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">)</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Behavior</span></strong>= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">:</span></p> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Bacula reads the </spa= n><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">$CREDENTIA= LS_DIRECTORY</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> environment variable (set by systemd).</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">It constructs the full path: </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">$CREDENTIA= LS_DIRECTORY/credential_name</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">.</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">It attempts to read th= e secret from this path.</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">It inherits the "don't fail early" logic from </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">dynfile:</= span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> for configuration checks (if </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">$CREDENTIA= LS_DIRECTORY</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> isn't set or the path doesn't yet exist during </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">-t</span><= span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">).</span></p> </li> </ul> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Advantages</span></stron= g><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">:</span></p> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Simplifies configuration for users on systemd: they only need the credential name, not the full runtime path.</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">More robust as it adapts to the actual path provided by systemd via </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">$CREDENTIA= LS_DIRECTORY</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">.</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Represents a relativel= y "simple win" for a large and growing portion of the Linux user base, offering a clean, secure, and modern way to handle secrets.</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Implementation could leverage the underlying logic developed for </spa= n><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">dynfile:</= span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">, making it a comparatively straightforward addition.</span></p= > </li> </ul> </li> </ul> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= ><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d">Applicability to TLS Keys/Passphrases:</span></strong><span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"><br> </span></span></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d">These </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">file:</span><spa= n _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d">, </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">dynfile:</span><= span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d">, and </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">syscred:</span><= span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> mechanisms could also be extended to directives like a new </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">TLS Key Passphrase</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> if Bacula were to support encrypted TLS private keys (leveraging the linked OpenSSL library which can handle decryption given a passphrase). This would be a significant security hardening step for TLS keys. </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">TLS Key =3D "dynfile:/path/to/key_provided_by_systemd"</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> is also an option if systemd provides the decrypted key directly.</span></span></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= ><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d">4. The </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">credstore:name:s= ecret_identifier</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> Directive (External Credential Store Helper)</span></st= rong><span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"> </sp= an></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >For maximum flexibility and integration with various secret managers (Vault, AWS Secrets Manager, Azure Key Vault, etc.) and platforms:</span></p> <ul> <li><span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Syntax</span></strong>= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">:</span></p> </span></li> </ul> <blockquote><span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">In resource: </span><s= pan _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">Password =3D "credstore:myvault:database/production/db_password"</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">New Stanza:</span></p> <span class=3D"mat-expansion-indicator ng-star-inserted">= </span> <div class=3D"mat-expansion-panel-content-wrapper"> <div role=3D"region" class=3D"mat-expansion-panel-content" id=3D"cdk-accordion-child-81" aria-labelledby=3D"mat-expansion-panel-header-81"= > <div class=3D"mat-expansion-panel-body"> <div _ngcontent-ng-c289253575=3D"" class=3D"syntax-highlighted-code-wrapper"> <div _ngcontent-ng-c289253575=3D"" class=3D"syntax-highlighted-code"> <pre _ngcontent-ng-c289253575=3D""><code _ngcontent-ng-c289253575=3D"">Credstore { N= ame =3D <span class=3D"hljs-string">"myvault"</span> Exec= =3D <span class=3D"hljs-string">"/usr/local/bin/bacul= a-secret-helper --store vault --secret %s"</span> <span class=3D"hljs-comment"># Or: Exec =3D "/usr= /local/bin/fetch-from-aws --secret %s"</span> Timeout =3D <span class=3D"hljs-number">5</span> <span class=3D"hljs-comment"># Optional timeout f= or the helper</span> }</code> </pre> </div> </div> </div> </div> </div> </li> </ul> </span></blockquote> <p><br> </p> <ul> <li><span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"> </= span><br> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Behavior</span></strong>= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">:</span></p> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Bacula forks and executes the specified </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">Exec</span= ><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> command, substituting </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">%s</span><= span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> (or other placeholders) with the </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">secret_ide= ntifier</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">.</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">The helper script/program is responsible for fetching the secret from the external store and printing it to its standard output.</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Bacula reads the secre= t from the helper's stdout.</span></p> </li> </ul> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Advantages</span></stron= g><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">:</span></p> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Extremely flexible: supports any secret manager via custom helper scripts.</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Platform-agnostic core mechanism (</span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">exec</span= ><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">).</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Aligns with how many other enterprise tools manage externalized secrets.</span></p> </li> </ul> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Considerations</span></s= trong><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">:</span></p> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Significantly more involved to implement in Bacula (process management, IPC, timeout handling, error checking from helper, argument substitution).</sp= an></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Potential performance implications if secrets are fetched very frequently (though caching within Bacula could mitigate this).</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Careful design needed for config check mode (e.g., should helpers be executed?).</span></p> </li> </ul> </li> </ul> <p><span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"> </sp= an></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"> </sp= an></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <strong _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= ><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d">Discussion Points:</span></strong></p> <ul _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= > <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Is there general interest in these types of enhancements, understanding they would be optional additions?</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><span _ngcontent-ng-c233927227=3D"" class=3D"router-outlet-wrapper ng-tns-c233927227-0"> = </span></p> <br> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Would the proposed </span>= <span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">file:</span><s= pan _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> directive be a welcome foundational feature?</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Following that, would </sp= an><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">dynfile:</span= ><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> (with its specific config-check behavior) be a good next step?</span></p= > </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Given its potential ease o= f implementation and wide user base on systemd, is </sp= an><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">syscred:</span= ><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> a desirable simplification, despite being OS-specific?</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Is the more comprehensive = </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">credstore:exec= :</span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"> model something the community sees a long-term need for, despite the implementation effort?</span></p> </li> <li _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserte= d"> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-insert= ed"><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">Are there other approaches or considerations I might have missed?</span></p> </li> </ul> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >I believe even the simpler </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">dynfile:</span><sp= an _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= > and </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">syscred:</span><sp= an _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= > options would offer substantial benefits to many Bacula users by improving security and manageability without impacting existing setups. The </span><span _ngcontent-ng-c4063671643=3D"" class=3D"inline-code ng-star-inserted">credstore:</span><= span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= > approach provides a path for even more advanced integrations.</span></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >Looking forward to your thoughts and feedback.</span></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >Thanks,</span></p> <p _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted">= <span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"= >Clinton Bunch<br> </span><span _ngcontent-ng-c4063671643=3D"" class=3D"ng-star-inserted"></span></p> _______________________________________________ <br> Bacula-devel mailing list <br> <a class=3D"moz-txt-link-abbreviated" href=3D"mailto:Bacula-d= [email protected]">[email protected]</a> <br> <a class=3D"moz-txt-link-freetext" href=3D"https://lists.sour= ceforge.net/lists/listinfo/bacula-devel">https://lists.sourceforge.net/li= sts/listinfo/bacula-devel</a> <br> </div> </div> </blockquote> </blockquote> </body> </html> --------------iqXJ3YnuwNPOqX65r0FD4JNh-- --===============7306853595275334604== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============7306853595275334604== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Bacula-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/bacula-devel --===============7306853595275334604==--