I'm sufficiently new to Linux that I don't understand how to do what I think I want. If you think you know what I actually want, please tell me.

I would like to use Duplicity to backup privileged data on remote servers in a pull fashion. The only method that comes to mind is to mount the remote file system with sshfs (or similar) using the root user with a private key. That of course means that root ssh login is required (I think).

Is this simply a universal weakness of using a pull backup method rather than push?

The alternative would be to run duplicity on each server and push the data to a single server using sudo locally, and a remote non-privileged user account to store the data. Is this better?

  • There is a things called "ssh forced commands", where even if you enable root login with private/public key pairs, the remote machine can say "but this key will not give you a shell, it will only start a fixed other command". (This is often used for source code repositories like github, where you connect with ssh, but you're not really supposed to have a full shell account.) – Ulrich Schwarz Jul 7 at 12:46
  • Okay, in the sshfs scenario, it is only SFTP access that is required, not shell access, and commands are required, I suppose unless there are commands issued for SFTP. Is it enough then to specify "forced commands" but then not associate any commands with any keys? – Brian Jul 7 at 13:01
  • I found this which gives a bit more description (now that I know what to search for) and I think I understand: superuser.com/questions/430053/… – Brian Jul 7 at 13:10
  • I just tried setting forced-commands-only and it accepts the key, but my ssh client (Windows - BitviseSSH) indicates the login failed. Is there a command that needs to be permitted for sftp only access? – Brian Jul 7 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.