I want to
rsync my server to back up its content. I want to preserve owner/group so that I can later restore the server using the backup. However the server has a different set of users and groups than my local machine, so it doesn't make sense to use native users. I also don't want to run
rsync as a root because of security implications. How can I do it?
I want to
migrated from serverfault.com Sep 18 '16 at 11:56
This question came from our site for system and network administrators.
You could write a script which saves permissions, user, group per file, maybe just like
getfacl -R / > /tmp/permissions.txt
to be restored if needed by
Then rsync everything including permissions.txt to a normal user account on the backup host.
The downside is that permissions.txt may not be 100% synchron to the actual backup.
Note saving secret files with wrong permissions under a normal user account might be also a security issue! At least the directory containing the whole backup should be readable only by the backup user.
One more security note: permissions.txt on the original host should be also protected, readable only by root.
I can't offer a solution that doesn't run as root but I can offer the following:
First, if you use
--numeric-ids it will preserve the UID/GIDs. If you do a restore with
tar (or anything that doesn't mess with UID/GIDs) you'll be fine.
rsync -avP --numeric-ids
However not running as root is going to be a problem because Unix requires
root to create files as another user. You might be able to use selinux to give the command permissions to write any file, but that is rather complex (though
--fake-super will help)
Would it meet your security requirements if the backup server used root and the other side didn't?
# run this on the backup host: rsync -avP --numeric-ids user@SOURCEHOST:/path/to/files/. /path/to/dest/.
As long as root@BACKUPHOST can ssh to user@SOURCEHOST, you'll be fine. Well, mostly fine. If
user can't access a file, it won't get backuped. Depending on your situation, that may not be an issue.