Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just figured out how to automate my rsync backups using authorized_keys and the command= parameter so that my rsync script can't be modified by the user.

So my authorized key file looks like this:

command="rsync --server -vlogDtprze.iLsf . /mybackupfolder/Pictures" ssh-rsa AAAAB3Nz…

The rsync script I run from the computer being backed up is:

rsync -avz -e ssh /home/me/Pictures tester@ </b>

What I want to do is back up /home/me/Pictures and /home/me/Documents. Just those two directories.

How do I accomplish this but keep it secure? The thing I like about the authorized keys file setting is that the user can't change where the backup is going...just what is being backed up.

share|improve this question

migrated from serverfault.com Feb 28 '14 at 21:25

This question came from our site for system and network administrators.

up vote 1 down vote accepted

This worked for me:

Local command:

rsync -avzr -e ssh /home/me/Documents /home/me/Pictures tester@

Remote authorized_hosts contents:

command="rsync --server -vvlogDtprze.iLsf . /mybackupfolder/" ssh-rsa AAAAB...
share|improve this answer
Genius. This worked perfectly. Thanks – user277244 Feb 14 '14 at 17:29

You need to create a separate ssh keypair for each command you want to run on the remote end. Use that key to back up each directory. Something like this:

command="rsync --server -vlogDtprze.iLsf . /mybackupfolder/Pictures" ssh-rsa AAAAB3Nz--etc
command="rsync --server -vlogDtprze.iLsf . /mybackupfolder/Documents" ssh-rsa BBAAA--etc 

On the side you are backing up you will need to specify the ssh keypair to use for ssh using the -i identity_file_for_each_command. Probably the simplest way to do this is to use a wrapper script around ssh for each backup.

share|improve this answer

To make it "easier" and secure, I would setup a chroot environment for the tester user :

sshd_config :

Match user tester
        ChrootDirectory /mybackupfolder/Pictures
        AllowTcpForwarding no

in the tester user chroot directory, create the following folder and copy the libraries :

|-- lib
|   `-- x86_64-linux-gnu
|       |-- libacl.so.1
|       |-- libattr.so.1
|       |-- libc.so.6
|       `-- libpopt.so.0
|-- lib64
|   `-- ld-linux-x86-64.so.2
`-- usr
    `-- bin
        `-- rsync

Then when the tester user will connect the remote machine, he will only be able to sync the files included in its chrooted environment.

share|improve this answer
I went with the other answer because as far as I can tell, it is fully secured. I tried to chroot before I came across the other solution, but just could never get it to work. Rsync had issues running in my chroot. I wanted to keep it simple but still secure. – user277244 Feb 14 '14 at 17:30
ehhh... WHAT??? – JohannesM Feb 28 '14 at 21:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.