I have two Debian 8 servers:
- Server A: at home, lots of storage
- Server B: vps at commercial host, running web and mail services
Both are pet projects, not business stuff.
Server B runs rsnapshot which works fine. Server A and B can SSH to each other passwordlesly with certificates, that also works fine. They do not allow root to SSH in directly but they have regular user accounts that can sudo su to become root. For non-automated SSH sessions I use password protected certs.
The last couple of days I have been trying to set up rsnapshot on server B to create backups from server B to server A, or on server A to pull backups from server B to server A, which seems the proper way according to rsnapshot documentation.
My problem is that a lot a documentation mentions servers relatively, for example they say 'do x on your server' or 'copy y to ~/somepath'. Seldom did I find documentation that explicitly lays out which server has which functions and which user's home directory it is that you need to copy y to.
So:
- The production data that needs to be backed up is on server B.
- The backups need to be saved to server A.
- Server A is going to run rsnapshot.
Questions:
In the rsnapshot config, which user account do I need to say is going to log in via SSH on server B? Either root (which gets either complicated or unsafe) or a dedicated regular user account, for example a user called 'backupmaker' (Debian has a system user called 'backup' which is eligable but I don't want to mess with).
I have read both and I understand the Linux mantra that more ways can be fine but I am really looking for some practicle advice from someone who has this set up in a production environment, preferably with relevant lines from /etc/rsnapshot.conf and /home//.ssh/authorized_keys (do you really use from="a.b.c.d",command="/home/remoteuser/cron/validate-rsync", and is that 'validate-rsync' script mandatory or can it be any command, e.g. /home/serverAuser/myrsnapscript.sh?).
Do you use the root account for creating backups on server B, a regular user account, a custom dedicated account or the built-in 'backup' account?
I am not looking for sshfs or other alternatives; I want to do this right, maybe expand it to a hub backup system later on.
Any insights and advice are welcome!