I am trying to setup ssh-key based login for a remote server to rsnapshot daily. The key I am using is a normal user key, but it obviously doesn't have root access, so when rsnapshot connects to the server with the user key, /root for example won't be backed up. What is the best way to setup rsnapshot in the simplest possible way? Should I just create a normal backup user, and add it to the wheel group and be done with it?


A perhaps not so simple way is to connect as root but to limit the key used to connect to only run specific invocations of rsync; this requires an /root/.ssh/authorized_keys entry along the lines of

 from="192.0.2.*",command="/root/limit-rsnap" ssh-rsa AAAAB3N...

which limits both where the backup is expected to originate from (this may not be ideal for all setups) and more importantly in the /root/limit-rsnap script on the system being connected to only specific calls to rsync are allowed:


shopt -s extglob

test -n "$SSH_ORIGINAL_COMMAND" || exit 1

  'rsync --server --sender -'+([vnlHogDtprRxe.isfLS])' --numeric-ids . '*)
    RSYNCPATH="${SSH_ORIGINAL_COMMAND#rsync --server --sender -+([vnlHogDtprRxe.isfLS]) --numeric-ids . }"
    test -e "$RSYNCPATH" && exec $SSH_ORIGINAL_COMMAND || exit 1
    exit 1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.