How can I provide my password if I'm running borgmatic through a systemd unit? #762

New Issue

PopeRigby · 2023-09-30T00:48:11Z

PopeRigby commented

2023-09-30 00:48:11 +00:00

What I'm trying to do and why

I'm trying to setup Borgmatic to run with systemd. I'm using repokey mode, so I have to give my password.

I tried editing my systemd drop-in to have Environment="BORG_PASSPHRASE=REDACTED", but that didn't work:

Steps to reproduce

sudo borgmatic rcreate --encryption repokey-aes-ocb
sudo systemctl enable borgmatic.timer

Actual behavior

I get this error in the systemd journal:

Sep 19 16:42:49 haddock borgmatic[97984]: CRITICAL borgbase: Error running actions for repository
Sep 19 16:42:49 haddock borgmatic[97984]: CRITICAL /usr/lib64/python3.11/getpass.py:91: GetPassWarning: Can not control echo on the terminal.
                                          Warning: Password input may be echoed.
                                          Enter passphrase for key ssh://byr71ulz@byr71ulz.repo.borgbase.com/./repo:
                                          can not acquire a passphrase: BORG_PASSPHRASE is not set. BORG_PASSCOMMAND is not set. Interactive password query failed.

Expected behavior

Borgmatic is able to read my password

Other notes / implementation ideas

No response

borgmatic version

1.8.2

borgmatic installation method

Fedora package

Borg version

1.2.6

Python version

Python 3.11.5

Database version (if applicable)

No response

Operating system and version

Fedora 38

### What I'm trying to do and why I'm trying to setup Borgmatic to run with systemd. I'm using repokey mode, so I have to give my password. I tried editing my systemd drop-in to have `Environment="BORG_PASSPHRASE=REDACTED"`, but that didn't work: ### Steps to reproduce 1. `sudo borgmatic rcreate --encryption repokey-aes-ocb` 2. `sudo systemctl enable borgmatic.timer` ### Actual behavior I get this error in the systemd journal: ``` Sep 19 16:42:49 haddock borgmatic[97984]: CRITICAL borgbase: Error running actions for repository Sep 19 16:42:49 haddock borgmatic[97984]: CRITICAL /usr/lib64/python3.11/getpass.py:91: GetPassWarning: Can not control echo on the terminal. Warning: Password input may be echoed. Enter passphrase for key ssh://byr71ulz@byr71ulz.repo.borgbase.com/./repo: can not acquire a passphrase: BORG_PASSPHRASE is not set. BORG_PASSCOMMAND is not set. Interactive password query failed. ``` ### Expected behavior Borgmatic is able to read my password ### Other notes / implementation ideas _No response_ ### borgmatic version 1.8.2 ### borgmatic installation method Fedora package ### Borg version 1.2.6 ### Python version Python 3.11.5 ### Database version (if applicable) _No response_ ### Operating system and version Fedora 38

witten commented

2023-09-30 02:42:13 +00:00

Setting the BORG_PASSPHRASE environment variable should work, although I guess it's conceivable there's a borgmatic bug around that. (There are several other options for providing your password to borgmatic as well.) Some things to try:

Can I get a look at your full systemd service (with anything redacted that you don't want to share)?
Make sure Environment="BORG_PASSPHRASE=REDACTED" is under the [Service] heading in your service file.
Have you reloaded the systemd daemon after modifying the service file? Example: sudo systemctl daemon-reload?
The environment variable being set should show up in your service logs. For instance, run journalctl -xeu borgmatic.service and you should see something like Sep 30 04:24:42 fedora38 borgmatic.service[1234]: BORG_PASSPHRASE=REDACTED. If you don't see that, it could indicate the environment variable is not actually getting set.

Setting the `BORG_PASSPHRASE` environment variable _should_ work, although I guess it's conceivable there's a borgmatic bug around that. (There are several other options for [providing your password to borgmatic](https://torsion.org/borgmatic/docs/how-to/provide-your-passwords/) as well.) Some things to try: * Can I get a look at your full systemd service (with anything redacted that you don't want to share)? * Make sure `Environment="BORG_PASSPHRASE=REDACTED"` is under the `[Service]` heading in your service file. * Have you reloaded the systemd daemon after modifying the service file? Example: `sudo systemctl daemon-reload`? * The environment variable being set should show up in your service logs. For instance, run `journalctl -xeu borgmatic.service` and you should see something like `Sep 30 04:24:42 fedora38 borgmatic.service[1234]: BORG_PASSPHRASE=REDACTED`. If you don't see that, it could indicate the environment variable is not actually getting set.

witten added the

question / support

label 2023-09-30 02:42:22 +00:00

PopeRigby commented

2023-10-01 02:29:49 +00:00

Setting the BORG_PASSPHRASE environment variable should work, although I guess it's conceivable there's a borgmatic bug around that. (There are several other options for providing your password to borgmatic as well.)

Oh, I might try one of those options then. Is there a recommend way to provide your password for a systemd unit?

Can I get a look at your full systemd service (with anything redacted that you don't want to share)?

I just used sudo systemctl edit borgmatic.service to make a drop-in file, but the contents of that is this:

[Service]
Environment="BORG_PASSPHRASE=REDACTED"

The contents of the unit file at /usr/lib/systemd/system/borgmatic.conf:

[Unit]
Description=borgmatic backup
Wants=network-online.target
After=network-online.target
# Prevent borgmatic from running unless the machine is plugged into power. Remove this line if you
# want to allow borgmatic to run anytime.
ConditionACPower=true

[Service]
Type=oneshot

# Security settings for systemd running as root, optional but recommended to improve security. You
# can disable individual settings if they cause problems for your use case. For more details, see
# the systemd manual: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
LockPersonality=true
# Certain borgmatic features like Healthchecks integration need MemoryDenyWriteExecute to be off.
# But you can try setting it to "yes" for improved security if you don't use those features.
MemoryDenyWriteExecute=no
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
ProtectClock=yes
ProtectControlGroups=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
# To restrict write access further, change "ProtectSystem" to "strict" and uncomment
# "ReadWritePaths", "ReadOnlyPaths", "ProtectHome", and "BindPaths". Then add any local repository
# paths to the list of "ReadWritePaths" and local backup source paths to "ReadOnlyPaths". This
# leaves most of the filesystem read-only to borgmatic.
ProtectSystem=full
# ReadWritePaths=-/mnt/my_backup_drive
# ReadOnlyPaths=-/var/lib/my_backup_source
# This will mount a tmpfs on top of /root and pass through needed paths
# ProtectHome=tmpfs
# BindPaths=-/root/.cache/borg -/root/.config/borg -/root/.borgmatic

# May interfere with running external programs within borgmatic hooks.
CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_NET_RAW

# Lower CPU and I/O priority.
Nice=19
CPUSchedulingPolicy=batch
IOSchedulingClass=best-effort
IOSchedulingPriority=7
IOWeight=100

Restart=no
# Prevent rate limiting of borgmatic log events. If you are using an older version of systemd that
# doesn't support this (pre-240 or so), you may have to remove this option.
LogRateLimitIntervalSec=0

# Delay start to prevent backups running during boot. Note that systemd-inhibit requires dbus and
# dbus-user-session to be installed.
ExecStartPre=sleep 1m
ExecStart=systemd-inhibit --who="borgmatic" --what="sleep:shutdown" --why="Prevent interrupting scheduled backup" /usr/bin/borgmatic --verbosity -2 --syslog-verbosity 1

Have you reloaded the systemd daemon after modifying the service file? Example: sudo systemctl daemon-reload?

Yep, I made sure to do that.

The environment variable being set should show up in your service logs. For instance, run journalctl -xeu borgmatic.service and you should see something like Sep 30 04:24:42 fedora38 borgmatic.service[1234]: BORG_PASSPHRASE=REDACTED. If you don't see that, it could indicate the environment variable is not actually getting set.

I can't find it in the log, but here it is:

Sep 30 19:26:27 haddock borgmatic[4016410]: INFO borgbase: Creating archive
Sep 30 19:26:31 haddock borgmatic[4016410]: INFO /usr/lib64/python3.11/getpass.py:91: GetPassWarning: Can not control echo on the terminal.
Sep 30 19:26:31 haddock borgmatic[4016410]: INFO Warning: Password input may be echoed.
Sep 30 19:26:31 haddock borgmatic[4016410]: INFO Enter passphrase for key ssh://byr71ulz@byr71ulz.repo.borgbase.com/./repo:
Sep 30 19:26:32 haddock borgmatic[4016410]: INFO can not acquire a passphrase: BORG_PASSPHRASE is not set. BORG_PASSCOMMAND is not set. Interactive password query failed.
Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL borgbase: Error running actions for repository
Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL Command 'borg create --info ssh://byr71ulz@byr71ulz.repo.borgbase.com/./repo::{hostname}-{now:%Y-%m-%dT%H:%M:%S.%f} /etc /root /var/home/cassidy/.config /var/home/cassidy/.local/share/containers/storage/volumes /var/home/shane' re>
Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL /etc/borgmatic/config.yaml: An error occurred
Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL
Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL summary:
Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL /etc/borgmatic/config.yaml: An error occurred
Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL borgbase: Error running actions for repository
Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL /usr/lib64/python3.11/getpass.py:91: GetPassWarning: Can not control echo on the terminal.
                                            Warning: Password input may be echoed.
                                            Enter passphrase for key ssh://byr71ulz@byr71ulz.repo.borgbase.com/./repo:
                                            can not acquire a passphrase: BORG_PASSPHRASE is not set. BORG_PASSCOMMAND is not set. Interactive password query failed.
Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL Command 'borg create --info ssh://byr71ulz@byr71ulz.repo.borgbase.com/./repo::{hostname}-{now:%Y-%m-%dT%H:%M:%S.%f} /etc /root /var/home/cassidy/.config /var/home/cassidy/.local/share/containers/storage/volumes /var/home/shane' re>
Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL
Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL Need some help? https://torsion.org/borgmatic/#issues
Sep 30 19:26:32 haddock systemd-inhibit[4016408]: /usr/bin/borgmatic failed with exit status 1.
Sep 30 19:26:32 haddock systemd[1]: borgmatic.service: Main process exited, code=exited, status=1/FAILURE

> Setting the `BORG_PASSPHRASE` environment variable _should_ work, although I guess it's conceivable there's a borgmatic bug around that. (There are several other options for [providing your password to borgmatic](https://torsion.org/borgmatic/docs/how-to/provide-your-passwords/) as well.) Oh, I might try one of those options then. Is there a recommend way to provide your password for a systemd unit? > * Can I get a look at your full systemd service (with anything redacted that you don't want to share)? I just used `sudo systemctl edit borgmatic.service` to make a drop-in file, but the contents of that is this: ``` [Service] Environment="BORG_PASSPHRASE=REDACTED" ``` The contents of the unit file at `/usr/lib/systemd/system/borgmatic.conf`: ``` [Unit] Description=borgmatic backup Wants=network-online.target After=network-online.target # Prevent borgmatic from running unless the machine is plugged into power. Remove this line if you # want to allow borgmatic to run anytime. ConditionACPower=true [Service] Type=oneshot # Security settings for systemd running as root, optional but recommended to improve security. You # can disable individual settings if they cause problems for your use case. For more details, see # the systemd manual: https://www.freedesktop.org/software/systemd/man/systemd.exec.html LockPersonality=true # Certain borgmatic features like Healthchecks integration need MemoryDenyWriteExecute to be off. # But you can try setting it to "yes" for improved security if you don't use those features. MemoryDenyWriteExecute=no NoNewPrivileges=yes PrivateDevices=yes PrivateTmp=yes ProtectClock=yes ProtectControlGroups=yes ProtectHostname=yes ProtectKernelLogs=yes ProtectKernelModules=yes ProtectKernelTunables=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK RestrictNamespaces=yes RestrictRealtime=yes RestrictSUIDSGID=yes SystemCallArchitectures=native SystemCallFilter=@system-service SystemCallErrorNumber=EPERM # To restrict write access further, change "ProtectSystem" to "strict" and uncomment # "ReadWritePaths", "ReadOnlyPaths", "ProtectHome", and "BindPaths". Then add any local repository # paths to the list of "ReadWritePaths" and local backup source paths to "ReadOnlyPaths". This # leaves most of the filesystem read-only to borgmatic. ProtectSystem=full # ReadWritePaths=-/mnt/my_backup_drive # ReadOnlyPaths=-/var/lib/my_backup_source # This will mount a tmpfs on top of /root and pass through needed paths # ProtectHome=tmpfs # BindPaths=-/root/.cache/borg -/root/.config/borg -/root/.borgmatic # May interfere with running external programs within borgmatic hooks. CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_NET_RAW # Lower CPU and I/O priority. Nice=19 CPUSchedulingPolicy=batch IOSchedulingClass=best-effort IOSchedulingPriority=7 IOWeight=100 Restart=no # Prevent rate limiting of borgmatic log events. If you are using an older version of systemd that # doesn't support this (pre-240 or so), you may have to remove this option. LogRateLimitIntervalSec=0 # Delay start to prevent backups running during boot. Note that systemd-inhibit requires dbus and # dbus-user-session to be installed. ExecStartPre=sleep 1m ExecStart=systemd-inhibit --who="borgmatic" --what="sleep:shutdown" --why="Prevent interrupting scheduled backup" /usr/bin/borgmatic --verbosity -2 --syslog-verbosity 1 ``` > * Have you reloaded the systemd daemon after modifying the service file? Example: `sudo systemctl daemon-reload`? Yep, I made sure to do that. > * The environment variable being set should show up in your service logs. For instance, run `journalctl -xeu borgmatic.service` and you should see something like `Sep 30 04:24:42 fedora38 borgmatic.service[1234]: BORG_PASSPHRASE=REDACTED`. If you don't see that, it could indicate the environment variable is not actually getting set. I can't find it in the log, but here it is: ``` Sep 30 19:26:27 haddock borgmatic[4016410]: INFO borgbase: Creating archive Sep 30 19:26:31 haddock borgmatic[4016410]: INFO /usr/lib64/python3.11/getpass.py:91: GetPassWarning: Can not control echo on the terminal. Sep 30 19:26:31 haddock borgmatic[4016410]: INFO Warning: Password input may be echoed. Sep 30 19:26:31 haddock borgmatic[4016410]: INFO Enter passphrase for key ssh://byr71ulz@byr71ulz.repo.borgbase.com/./repo: Sep 30 19:26:32 haddock borgmatic[4016410]: INFO can not acquire a passphrase: BORG_PASSPHRASE is not set. BORG_PASSCOMMAND is not set. Interactive password query failed. Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL borgbase: Error running actions for repository Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL Command 'borg create --info ssh://byr71ulz@byr71ulz.repo.borgbase.com/./repo::{hostname}-{now:%Y-%m-%dT%H:%M:%S.%f} /etc /root /var/home/cassidy/.config /var/home/cassidy/.local/share/containers/storage/volumes /var/home/shane' re> Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL /etc/borgmatic/config.yaml: An error occurred Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL summary: Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL /etc/borgmatic/config.yaml: An error occurred Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL borgbase: Error running actions for repository Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL /usr/lib64/python3.11/getpass.py:91: GetPassWarning: Can not control echo on the terminal. Warning: Password input may be echoed. Enter passphrase for key ssh://byr71ulz@byr71ulz.repo.borgbase.com/./repo: can not acquire a passphrase: BORG_PASSPHRASE is not set. BORG_PASSCOMMAND is not set. Interactive password query failed. Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL Command 'borg create --info ssh://byr71ulz@byr71ulz.repo.borgbase.com/./repo::{hostname}-{now:%Y-%m-%dT%H:%M:%S.%f} /etc /root /var/home/cassidy/.config /var/home/cassidy/.local/share/containers/storage/volumes /var/home/shane' re> Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL Sep 30 19:26:32 haddock borgmatic[4016410]: CRITICAL Need some help? https://torsion.org/borgmatic/#issues Sep 30 19:26:32 haddock systemd-inhibit[4016408]: /usr/bin/borgmatic failed with exit status 1. Sep 30 19:26:32 haddock systemd[1]: borgmatic.service: Main process exited, code=exited, status=1/FAILURE ```

witten commented

2023-10-01 04:35:36 +00:00

Oh, I might try one of those options then. Is there a recommend way to provide your password for a systemd unit?

The short answer is no, there isn't, as how you pass passwords to a system service varies based on your requirements and threat model. Some light reading on the topic can be found here though: https://unix.stackexchange.com/questions/391040/is-there-a-typical-way-to-pass-a-password-to-a-systemd-unit-file

I just used sudo systemctl edit borgmatic.service to make a drop-in file, but the contents of that is this:

So I've never used systemd drop-in files before. The fact the the passphrase envirionment variable doesn't show up in logs makes me think it's not working properly though. You could try putting the Environment= directly in the unit file to see if that fixes the problem. That would tell you something is going wrong with the drop-in.

I assume in addition to reloading the daemon, you've also run systemctl restart borgmatic.service after making changes?

> Oh, I might try one of those options then. Is there a recommend way to provide your password for a systemd unit? The short answer is no, there isn't, as how you pass passwords to a system service varies based on your requirements and threat model. Some light reading on the topic can be found here though: https://unix.stackexchange.com/questions/391040/is-there-a-typical-way-to-pass-a-password-to-a-systemd-unit-file > I just used sudo systemctl edit borgmatic.service to make a drop-in file, but the contents of that is this: So I've never used systemd drop-in files before. The fact the the passphrase envirionment variable doesn't show up in logs makes me think it's not working properly though. You could try putting the `Environment=` directly in the unit file to see if that fixes the problem. That would tell you something is going wrong with the drop-in. I assume in addition to reloading the daemon, you've also run `systemctl restart borgmatic.service` after making changes?

PopeRigby commented

2023-10-08 03:06:13 +00:00

@witten Sorry for the late response, I was away from my computer. Am I able to specify my encryption passphrase directly in the config.yaml?

Edit: Found it.

storage:
    encryption_passphrase: <passphrase>

@witten Sorry for the late response, I was away from my computer. Am I able to specify my encryption passphrase directly in the `config.yaml`? Edit: Found it. ```yaml storage: encryption_passphrase: <passphrase> ```

witten commented

2023-10-08 04:24:34 +00:00

Yup, that's it! Let me know whether that works out for you.