they're not all sys/sys on sources.
do an ls -l and you'll see.  they're sys/sys
in the replica logs, which is what gets used
to update your own machines.

run replica/pull as a special user that is a
member of group sys and drop the -u flag.
that's the easiest way to update a fossil
system.

the second easiest is to allocate an allowed
console using srv -A.