Howto set the Bacula Storage Daemon 's (bacula-sd) umask in Debian

The default Debian init script for the Bacula Storage Daemon is not providing a configuration option for the umask. Of cause it is possible to append a --umask to the start-stop-daemon lines init script but this is not update safe and last but not least it will change the checksums and intrusion detection scanners (debsums, tiger,...) will complain about this file. This leads to an ignore rule in the IDS which means more configuration, less security and more complexity.

The solution is to use a pam module named pam_umask. It is contained in the package libpam-modules which should be installed by default. After switching on the module the only thing that needs to be done is to add a umask setting to the Bacula users GECOS field.

For the copy paste fraction:

apt-get install libpam-modules
echo "session   optional   pam_umask.so" >> /etc/pam.d/common-session
usermod -c umask=027 bacula
/etc/init.d/bacula-sd restart

pam_umask can also be used this way to modify the umask of any specific daemon user without a shell.