Security model

What Automatic Database Backup can read and write, what it stores, and what leaves your instance.

A database backup is a complete copy of everything: every password hash, every customer record, every attachment. Configuring where those copies go is the most security-sensitive thing this module does, and the access model is built around that one fact.

Who can do what

There is deliberately no "backup user" group that can create destinations. A user who can point a backup at an arbitrary SFTP server can exfiltrate the entire database, and no amount of field-level restriction changes that. Creating destinations therefore stays with Settings-level users, who could already do it by other means.

The read-only group exists for the real case it leaves out: someone who needs to answer "did last night's backup work" without being handed the SFTP password. They see the run history — dates, sizes, results, errors — and nothing about where backups go. This is tested.

Credentials

The SFTP password is stored in the database like any other Odoo field and is rendered with password="True" so it is masked on screen. There is a test that asserts the attribute is still there, because losing it in a refactor would silently expose the password to everyone who walks past the desk.

If your policy forbids storing an SSH password at all, use a local destination and move the files off-box with your own key-based rsync or scp. That is a better arrangement anyway.

What the module can reach

• It writes only to the folder configured on a destination, and only files whose names it generates.
• It reads only dump.sql inside archives it just wrote, to verify them.
• It never reads or modifies any other Odoo record.

Deletion

Retention is the only thing this module deletes, and it is deliberately timid:

• Only in the destination's own folder.
• Only files starting with the configured database name and ending in a timestamp this module's own pattern produces and ending .zip or .sql.
• Never after a failed run.
• Never on SFTP destinations.

A file that does not match every one of those is left alone. There is a test that puts five plausible-looking foreign files in the folder and asserts all five survive — because a backup tool that deletes the wrong file is a catastrophe rather than a bug.

Network

Local destinations make no network calls at all.

SFTP destinations connect only to the host you configured, over SSH, using paramiko. paramiko is imported at the moment it is needed rather than declared as a hard dependency, so an administrator who only backs up locally never installs an SSH library on account of this module.

What goes in the log

Only the destination name, the filename, the size and the duration — plus the full traceback when a run fails, which is the point. No credentials, no database contents, and no SFTP password ever reach the log.

Protect the folder

The module cannot control what happens to a file after it writes it. On the server:

sudo chown odoo:odoo /var/backups/odoo
sudo chmod 750 /var/backups/odoo

Do not put backups anywhere served over HTTP, and do not put them in the Odoo filestore.

Reporting a vulnerability

Email info@technovision.dev. Please do not open a public issue.