2

I have a server set up to require public-key authentication for ssh access using a key with a password. Is there a way to set up a password-less key that will only be allowed when executing rsync over ssh, while still requiring the key and password for all other ssh access?

1

Create a separate RSA key just for rsync to use. Do not put a passphrase on that key. Give it a unique name, such as id_rsa_rsync for the private key and id_rsa_rsync.pub for the public key.

On the server, install the public key on a new line of ~/.ssh/authorized_keys, like this:

(server)$ cat << EOF >> .ssh/authorized_keys
command="rsync",no-pty,no-port-forwarding (paste your public key here)
EOF

Check the resulting file to make sure it looks sort of like this:

(server)$ tail -1 .ssh/authorized_keys
command="rsync",no-pty,no-port-forwarding ssh-rsa AAAAB3..blah..blah..HhcvQ== you@example.com

When you want to rsync from your local machine to the server, you will need to add -e 'ssh -i ~/.ssh/id_rsa_rsync' to tell rsync to use the new key you just set up:

rsync -av -e 'ssh -i ~/.ssh/id_rsa_rsync' local/files* server:/remote/path/

With some clever entries in your ~/.ssh/config file, you can simplify the rsync command line:

# this entry is used for normal logins to "server":
Host server
  IdentityFile ~/.ssh/id_rsa

# this entry is used for rsyncing to "server" without a passphrase:
Host server-rsync
  Hostname server
  IdentityFile ~/.ssh/id_rsa_rsync

The Hostname server line needs to specify a valid DNS name or /etc/hosts entry. With that config entry in place, your rsync command line becomes just:

rsync -av local/files* server-rsync:/remote/path/
3
  • So, per your last point, if I set up config in .ssh, I don't have to even tell rsync directly to use ssh, but it will look in the .ssh/config file automatically and use that? – Wallphoenix May 27 '19 at 18:53
  • Yes, if I understand you correctly. rsync uses ssh by default. But by default, ssh uses your normal key, which requires a passphrase. But if you set up the .ssh/config file, and then use the special hostname "server-rsync" (or one of your own choosing) in the rsync command line, then ssh will use the new key that does not require a passphrase. – Jim L. May 27 '19 at 22:51
  • I couldn't get this to work, then I discovered this method will allow executing rsync [b]on the server[/b] using the password-less key. I'm trying to use rsync on my local host to copy files to the server and I wasn't clear on that in my question. It put me on the right track, though, for an alternative. Thanks! – Wallphoenix May 29 '19 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.