2

on my LAN (debian server, windows client) I use rsync:// protocol with this code

cwRsync\rsync.exe -avLP --force --append-verify rsync://rsync-usb@server/rsync-usb/* usb/

I have read, that rsync in daemon mode with rsync:// protocol does not use encryption, so If I want to use rsync over internet, I want to use encryption. I like simplicity of rsync://user@server/module.

I do not want use ssh user with allowed login, because I do not want give access to my server.

I have created one user with blocked login 

rsyncssh:x:1001:1007:,,,:/tmp:/bin/false

Is there a way how to tunnel rsync:// protocol over ssh ? for example with plink.exe (putty link) and private user key ?

Improve this question

2 Answers 2

Reset to default
6

I often use SSH port tunneling to create an encrypted channel. Since you're using an rsync:// URL I assume you have the rsync daemon running on TCP port 873 on the remote server. We can forward this port as follows:

ssh -N -L 873:localhost:873 rsyncssh@server

The -N option prevents the execution of a remote command, which would in your case disconnect the session since there's no valid shell. You can now sync with your remote server by connecting to it over the forwarded port on the local host, i.e., running your old command but replace @server with @localhost.

You can also add the -f option to the SSH command to move SSH to the background which might be handy if you want to leave the connection open at all times. I'd recommend logging in with a private key for convenience and security.

In case you don't have an rsync daemon running on the remote server, set one up and use the documentation in man 5 rsyncd.conf if necessary.

Improve this answer
1
  • 1
    I'll just mention stunnel here for completeness' sake. I think your SSH solution is cleaner and easier to implement, but stunnel might be useful for a "permanent" connection.
    – Otheus
    May 26, 2015 at 16:17
-1

rsync can use directly ssh,using -e

rsync -avP -e /home/share/ remote:/home/share

otherwise a tunnel works fine,another solution can be stunell

Improve this answer
4
  • 1
    Does this command work without a remote shell? The OP has disabled it by setting it to /bin/false.
    – Benjamin B.
    May 26, 2015 at 16:58
  • I think no,but try
    – elbarna
    May 26, 2015 at 18:58
  • @BenjaminB. It doesn't.
    – Gilles 'SO- stop being evil'
    May 26, 2015 at 22:26
  • Try a tunnel,if even this doesn't work,use a restricted shell or a user with very limited privileges
    – elbarna
    May 26, 2015 at 23:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.