Just adding the user backups
to the user group sudo
does not automatically give the account access to all files on the system. It gives the user the permission to run the sudo
command.
Since you are using public key authentication (presumably without a passphrase), I would approach this with security and ease of implementation in mind. Using ssh
allows you to restrict the user to execute only very specific commands. In this case, you can allow the user backups
to execute rsync
with superuser permissions.
You have already performed the key exchange and verified authentication is successful. In the authorized_keys
file on the remote host that you are backing the /home
directory from, you can add a command=
directive to the key that is used by the user backups
. This directive will only allow that command to be run when that key is used for authentication. So the first field of the key would look similar to this:
command="/path/to/sudo /path/to/rsync -az /home /local/folder" ssh-rsa AAAAB3NzaC1yblahblahblah
You can go even further and add more options to the key, such as from=myhost,no-pty,no-X11-forwarding
.
This should give you decent security and not require you to modify the underlying file system permissions. You will probably need to play with the command that you place in the authorized_keys
file until it works like you expect; it may take a bit to wrap your brain around it. The command specified in the authorized_keys
will basically override the rsync
options you will pass from the connecting host.
Lots of good information in man sshd
. You want to specifically read the AUTHORIZED_KEYS FORMAT section.
/proc
,/dev
etc then errors are to be expected.backups
tosudo
andadmin
do not change anything./home/a/c/account/users/mail:username
which have permissions likedrwx------
and owned bymail:4096
. I assume that because userbackups
is in the groupsudo
oradmin
it doesn't have access because there are no access permissions for groups? I dunno, but its erroring on folders/files like that.rsync
command with sudo.