Rsync over SSH with authorized keys..but run 2 rsync commands

Question

I just figured out how to automate my rsync backups using authorized_keys and the command= parameter so that my rsync script can't be modified by the user.

So my authorized key file looks like this:

command="rsync --server -vlogDtprze.iLsf . /mybackupfolder/Pictures" ssh-rsa AAAAB3Nz…

The rsync script I run from the computer being backed up is:

rsync -avz -e ssh /home/me/Pictures [email protected]:/mybackupfolder/Pictures </b>

What I want to do is back up /home/me/Pictures and /home/me/Documents. Just those two directories.

How do I accomplish this but keep it secure? The thing I like about the authorized keys file setting is that the user can't change where the backup is going...just what is being backed up.

Answer 1

You need to create a separate ssh keypair for each command you want to run on the remote end. Use that key to back up each directory. Something like this:

command="rsync --server -vlogDtprze.iLsf . /mybackupfolder/Pictures" ssh-rsa AAAAB3Nz--etc
command="rsync --server -vlogDtprze.iLsf . /mybackupfolder/Documents" ssh-rsa BBAAA--etc 

On the side you are backing up you will need to specify the ssh keypair to use for ssh using the -i identity_file_for_each_command. Probably the simplest way to do this is to use a wrapper script around ssh for each backup.

Answer 2

This worked for me:

Local command:

rsync -avzr -e ssh /home/me/Documents /home/me/Pictures [email protected]:/mybackupfolder

Remote authorized_hosts contents:

command="rsync --server -vvlogDtprze.iLsf . /mybackupfolder/" ssh-rsa AAAAB...

Answer 3

To make it "easier" and secure, I would setup a chroot environment for the tester user :

sshd_config :

Match user tester
        ChrootDirectory /mybackupfolder/Pictures
        AllowTcpForwarding no

in the tester user chroot directory, create the following folder and copy the libraries :

.
|-- lib
|   `-- x86_64-linux-gnu
|       |-- libacl.so.1
|       |-- libattr.so.1
|       |-- libc.so.6
|       `-- libpopt.so.0
|-- lib64
|   `-- ld-linux-x86-64.so.2
`-- usr
    `-- bin
        `-- rsync

Then when the tester user will connect the remote machine, he will only be able to sync the files included in its chrooted environment.