1

I am trying to setup ssh-key based login for a remote server to rsnapshot daily. The key I am using is a normal user key, but it obviously doesn't have root access, so when rsnapshot connects to the server with the user key, /root for example won't be backed up. What is the best way to setup rsnapshot in the simplest possible way? Should I just create a normal backup user, and add it to the wheel group and be done with it?

1 Answer 1

2

A perhaps not so simple way is to connect as root but to limit the key used to connect to only run specific invocations of rsync; this requires an /root/.ssh/authorized_keys entry along the lines of

 from="192.0.2.*",command="/root/limit-rsnap" ssh-rsa AAAAB3N...

which limits both where the backup is expected to originate from (this may not be ideal for all setups) and more importantly in the /root/limit-rsnap script on the system being connected to only specific calls to rsync are allowed:

#!/bin/bash

shopt -s extglob

test -n "$SSH_ORIGINAL_COMMAND" || exit 1

case "$SSH_ORIGINAL_COMMAND" in
  'rsync --server --sender -'+([vnlHogDtprRxe.isfLS])' --numeric-ids . '*)
    RSYNCPATH="${SSH_ORIGINAL_COMMAND#rsync --server --sender -+([vnlHogDtprRxe.isfLS]) --numeric-ids . }"
    test -e "$RSYNCPATH" && exec $SSH_ORIGINAL_COMMAND || exit 1
    ;;
  *)
    exit 1
  ;;
esac

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .