Securing the Rescue Console

Bacula Enterprise Only

This solution is only available for Bacula Enterprise. For subscription inquiries, please reach out to sales@baculasystems.com.

The recommended ACLs setup for the rescue console is to use *All* for all ACLs. This allows you to restore any backup of any host using the same console. The drawback is that anybody getting the password of this console can restore any data to their own computer.

If you must delegate BMR privilege to people with limited permissions, you must create restricted consoles using Bacula ACL directives. For any of these consoles, you must create clients with the same name because WindowsBMR uses the setip command that requires that the client and the console use the same name.

Minimal ACLs

The minimal setup requires accesses to all resources needed to restore the backup. For example:

Console {
  Name = <rescue-fd>
  Password = <password>
  CatalogAcl = <catalog>
  ClientAcl = <rescue-fd>, <host-fd>
  JobAcl = <restore-job>, <winbmr-job>
  FilesetAcl = <restore-fileset>, <winbmr-fileset>
  PoolAcl = <pool>
  StorageAcl = <storage>
  WhereAcl = *all*
  # the following three ACLs are required when using Bacula Enterprise
  # version 8.1 or newer
  RestoreClientACL = <rescue-fd>
  UserIdACL = *all*
  DirectoryACL = *all*

  CommandAcl = .bvfs_cleanup, .bvfs_get_jobids, .bvfs_lsdirs, .bvfs_lsfiles, .bvfs_restore
  CommandAcl = .bvfs_update, cancel, .catalog, .clients, gui, .jobs, list, llist, q, quit
  CommandAcl = restore, setip, show, status, wait
  # .sql is not required anymore since WinBMR >= 3.4.0 and Bacula Enterprise > 8.4.2
  CommandAcl = .sql
}

Replace <tag> as follow :

rescue-fd: the name of the console and the file daemon.
host-fd: the host you want to restore.
restore-job: you must use a restore job that doesn’t run any script to do the recovery.
winbmr-job: this is the WindowsBMR-enabled job used to backup your host. If you have multiple jobs, add them to the list.
restore-fileset: is the Fileset used by the <restore-job>.
winbmr-fileset: This is the Fileset used by the <winbmr-job>.
pool: the list of pools which hold data you want to restore.
storage: the storage devices which store data you want to restore.

In practice, there may be multiple jobs, stored on different pools located on different storages. You must add ACLs for all these jobs depending on your configuration.

If you want to restore multiple hosts from the same WindowsBMR console, you must merge all the ACLs together.