I know your question is about rsync, but this may be helpful regarding backups. This is roughly how I do my offsite backups.
Rsync-based alternative Rdiff-backup
Rdiff-backup may be worth a try.
librsync) under water and handles all magic about permissions and attributes already for you, even when the target filesystem does not support it. This is possible because it will store this in its own format and that works cross-platform too.
As a bonus it also provides differential backups, so you can go 'back in time'. However, rdiff-backup may run slower due to the nature of differential backups.
About SSH keys and security
How am I supposed to be doing this? Should I have a passwordless
private key on A that logs into root on B? That seem's super
If you're scared about that, which is a sensible thing to be here, the following might be helpful. Prepend the following in one line with the public key you configure on the machine you like to back up (
command="rdiff-backup --server --restrict-read-only /",from="hostname.or.ip.address.to.allow",no-port-forwarding,no-X11-forwarding,no-pty ssh-rsa AAAA.... and the rest of your key in the same line.
This is an example using an RSA key. Change it to your needs.
Optionally, configure the SSH daemon to accept only keys with
This provides quite some security:
- Forced command login only for root, in this case running rdiff-backup in read-only server mode.
- Only authorizes if connection is made from a certain source (host).
- No TCP port and X forwardings allowed.
- No pty assigned.
- Possible security flaws in Rdiff-backup can be exploited.
- Keep your keys in a safe place, always. (Exclude them from your backup, for example!)