I'm setting up automated rsync across the network, using (or attempting to use) the following command:

 rsync -e ssh -avhxAXHr --rsync-path="sudo rsync" --exclude-from=:$EXCLUDEFILE --link-dest=$LINKDEST --files-from=:$SOURCES backupuser@${RMTHST}:/ $DESTDIR

I want to keep the source host in charge of what can be copied. To that end, I'm locking down the sudo entry for backupuser on the source host such that it has to pull the --files-from file from the source host. The sudoers entry looks like:

backupuser ALL(root:root) /usr/bin/rsync --server --sender -vlHogDtpAXrRxe.iLs --files-from /securepath/from-file . /

The rsync man page states:

...the --files-from file can be read from  the  remote host instead of the
local host if you specify a "host:" in front of the file (the host must
match one end of the transfer).  As a short-cut, you can specify just a
prefix of ":" to mean "use the remote end of the transfer". For example:

   rsync -a --files-from=:/path/file-list src:/ /tmp/copy

Since I'll be maintaining the --files-from file on the source host, it makes sense that I should maintain the --exclude-from file on the source host as well. However, the rsync man page does not describe a way to have it pull the --exclude-from file from the remote host, and my tests failed when using similar formatting as used for --files-from. From a security perspective, this isn't a big deal, but not being able to maintain the two files in the same location could become an administrative headache when dealing with several servers.

Am I missing something? Is there a way to have rsync pull both files from the remote server (short of running a separate initial rsync to pull the --exclude-from file first)?

1 Answer 1


If you have resorted to using sudo on the remote, and also want to keep control on the remote of what is accessed, you should also consider using rsync as a daemon instead. See man rsyncd.conf

It means that you open a door over which you can control what files are visible, in what direction data can go (eg read only), when the service is available and so on. You don't need sudo, and you can restrict which user logins are allowed.

In particular, you can specify an exclude file in /etc/rsyncd.conf with

 exclude from = somefilename

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .