Allow rsync to be run remotely as root, but only to read files. A read-only root user?

Question

I would like to use rsync-over-ssh to pull backups from many remote traget machines to a central backup.

I could do this as the root user, but that would allow me to accidentally run a bad rsync command which wrote to, or deleted from, a machine which should be being backed-up.

Is there anyway of putting a read-only-root user on the target machines?

The rsync command needs to be able to read any files on the target machines, but must not be able to write.

Answer 1

Run the read side of rsync as a dedicated non-root user but with the capability CAP_DAC_READ_SEARCH. The user should have a full view of the filesystem (of course) and access to a copy of /usr/bin/rsync which has this capability. I'm not very familiar with capabilities on Linux but I think this is how to set it up:

cp /usr/bin/rsync /usr/local/sbin/rsync-for-backup
chown root.root /usr/local/sbin/rsync-for-backup
chmod 700 /usr/local/sbin/rsync-for-backup
setfacl -m user:backupuser:rx /usr/local/sbin/rsync-for-backup
setcap cap_dac_read_search+ep /usr/local/sbin/rsync-for-backup

Remember to keep the copy updated whenever rsync is updated. Pass --rsync-path=/usr/local/sbin/rsync-for-backup on the other side.

(I assume Linux. Other Unix variants would need other solutions.)

---

Some other potential approaches:

• The bindfs solution from https://unix.stackexchange.com/a/91522 would let you read file contents but would mangle some metadata. I'm not sure offhand if there's a way to make this work for backups.
• Running as root but with restrictive SELinux rules should do the trick, but don't ask me what the rules would have to be.

Answer 2

You would need to run the rsync as a user on the remote system that has read-only rights. E.g. rsync -a read_only_user@target_machine:/path/to/files /backup/location

It's worth noting that rsync will only delete files when used with the --delete flag.

You might have a look at the rsync wrapper rrsync where you can specify a -ro flag.

For your use case I'd recommend to take a look at rsnapshot as well, as it is pretty convenient for a central backup while saving diskspace through utilization of hardlinks (https://rsnapshot.org).