I just figured out how to automate my rsync backups using authorized_keys and the command= parameter so that my rsync script can't be modified by the user.

So my authorized key file looks like this:

command="rsync --server -vlogDtprze.iLsf . /mybackupfolder/Pictures" ssh-rsa AAAAB3Nz…

The rsync script I run from the computer being backed up is:

rsync -avz -e ssh /home/me/Pictures [email protected]:/mybackupfolder/Pictures </b>

What I want to do is back up /home/me/Pictures and /home/me/Documents. Just those two directories.

How do I accomplish this but keep it secure? The thing I like about the authorized keys file setting is that the user can't change where the backup is going...just what is being backed up.

3 Answers 3


You need to create a separate ssh keypair for each command you want to run on the remote end. Use that key to back up each directory. Something like this:

command="rsync --server -vlogDtprze.iLsf . /mybackupfolder/Pictures" ssh-rsa AAAAB3Nz--etc
command="rsync --server -vlogDtprze.iLsf . /mybackupfolder/Documents" ssh-rsa BBAAA--etc 

On the side you are backing up you will need to specify the ssh keypair to use for ssh using the -i identity_file_for_each_command. Probably the simplest way to do this is to use a wrapper script around ssh for each backup.


This worked for me:

Local command:

rsync -avzr -e ssh /home/me/Documents /home/me/Pictures [email protected]:/mybackupfolder

Remote authorized_hosts contents:

command="rsync --server -vvlogDtprze.iLsf . /mybackupfolder/" ssh-rsa AAAAB...

To make it "easier" and secure, I would setup a chroot environment for the tester user :

sshd_config :

Match user tester
        ChrootDirectory /mybackupfolder/Pictures
        AllowTcpForwarding no

in the tester user chroot directory, create the following folder and copy the libraries :

|-- lib
|   `-- x86_64-linux-gnu
|       |-- libacl.so.1
|       |-- libattr.so.1
|       |-- libc.so.6
|       `-- libpopt.so.0
|-- lib64
|   `-- ld-linux-x86-64.so.2
`-- usr
    `-- bin
        `-- rsync

Then when the tester user will connect the remote machine, he will only be able to sync the files included in its chrooted environment.

  • I went with the other answer because as far as I can tell, it is fully secured. I tried to chroot before I came across the other solution, but just could never get it to work. Rsync had issues running in my chroot. I wanted to keep it simple but still secure.
    – user277244
    Feb 14, 2014 at 17:30
  • ehhh... WHAT???
    – JohannesM
    Feb 28, 2014 at 21:53

You must log in to answer this question.