2

I need to give access to some Mr X in my production server so that he can push files to my server. Since there is no necessity to give him shell access , I decided to use restricted shell (rssh) so that he can only copy files to my server without being able to access it. The file will be transferred using RSYNC over SSH .

The command that is being used to transfer the file is

rsync -ua  -e 'ssh -p 55'  /appdata/paths/ 192.168.4.172:/home/example/ 

But rsync over SSH using restricted shell does not seem to work fine

$ rsync -ua /appdata/paths/ -e 'ssh -p 565'
example@192.168.2.142:/home/example/
#################################################################################################################

 This service is restricted to authorized users only. All activities on this system     
 are logged.            ##
  ##   Unauthorized access will be fully investigated and reported to the appropriate     
 law enforcement agencies.  ##
#
  insecure -e option not allowed.
 This account is restricted by rssh.
 Allowed commands: scp rsync

  If you believe this is in error, please contact your system administrator.

  rsync: connection unexpectedly closed (0 bytes received so far) [sender]
  rsync error: error in rsync protocol data stream (code 12) at io.c(600) [sender=3.0.6]

It is working fine with scp, issue is with rsync only

3

You should use rrsync (probably available gzipped on your system e.g. in /usr/share/doc/rsync/scripts/) and associate a line in your authorized_keys file with the public key installed there for the rsync:

command="$HOME/bin/rrsync -ro ~/rsyncdir/",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding

If necessary more detail can be found here and here

  • I tried this . This works fine . But ssh is still accessible . I need to disable remote login but allowing only rsync – Zama Ques Dec 4 '14 at 9:28
  • @ZamaQues Have you looked at the the rrsync script. You probably need to include ... in the authorized keys file for the key and include that on the commandline ( This might also help). – Anthon Dec 4 '14 at 9:49
  • This restriction does not work. rrsync does not restrict (unless you deny all write access). man rsyncd.conf tells you that rsyncd security relies on the default value of "munge symlinks" (or "use chroot"). However, rrsync does not enforce the use of --munge-links ! There is an open bug since 2016. bugzilla.samba.org/show_bug.cgi?id=11879 Use rsyncd over ssh instead. See Q (with several tutorials linked in the answer) unix.stackexchange.com/questions/504301/… – sourcejedi Mar 6 at 11:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.