1

the problem is how to automatically transfer backups from server A to server B in the best possible way in terms of security?

Here is what comes to my mind:

  • authorize server A pub key to access server B
  • create user on server B only for backups
  • run ssh-agent on server A, enter password manually after restart
  • automatically copy files with scp from server A to server B

but if bad person gets access to server A, he will basically have access to server B also. So I have to restrict server B user? How can I do that, and is this the best way of doing this whole backup over network?

Regards

3 Answers 3

Reset to default
1
  • Do not allow server A to have implied ssh access to server B, nor allow server B to have implied ssh access to server A. Different passwords. No certificate-based logins. No trust.
  • Set up rsync as a dæmon on server A such that it offers read only access to the backups, and only from server B. Not over ssh, but directly.
  • Have server B copy the backups periodically with rsync from server A. (Not rsync over ssh, but using the rsync transport protocol)
  • Use a VPN or something like stunnel to protect rsync traffic between server A and server B.
0

you almost have it. user on server B must be given /bin/false as shell, this will forbid interactive login from server A (but file on server B can still be fetched or deleted).

Edit:

  • using /bin/false as a shell forbid copying
  • using /usr/sbin/nologin also (his account is currently not available.)

A more complex solution would involve vsftp (not ftps), but this require ssl certificates.

3
  • rather than /bin/false I'd recommend /bin/nologin, which gives a message if you try to login as them. I wasn't aware scp worked without a login, I thought it opened an SSH connection and would get kicked out.
    – Centimane
    Nov 30, 2015 at 11:20
  • Okay, but with nologin user will be able to download files maybe? Something like scp remoteUser@remoteserver:/etc/shadow .
    – nacholibre
    Nov 30, 2015 at 12:17
  • nologin and false forbid scp in either way. on a side note, you can't read /etc:shadow unless you are root.
    – Archemar
    Nov 30, 2015 at 12:20
0

I suggest a cronjob using scp to copy files.

Write a shellscript backupToServer.sh, which tars your files-to-backup and then puts them on the server with scp /path/to/backup/tar user@server:/path/where/backup/is/stored. make usage of ssh-keys.

You can use date or similar tools to name your backup correctly.

With crontab -e you add a new cronjob. Take a look at the time settings of crontab, they are rather trivial but look weird on first sight.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .