Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use rsync to mirror a number of folders on our failover server. However, some of our files, such as thumbnails or full-text indexes, are generated by our applications under the web user (named 'nobody'), and default to restrictive permissions.

Also, I'm doing this over ssh, where root access is disabled, and I'd like to keep it that way, if possible.

Is there any reasonable way I can tell rsync to run as sudo? Or should I look into changing the file permissions?

Thanks

share|improve this question
    
Have you considered ACLs? –  alex Jun 15 '10 at 19:54
    
"Root access is disabled" is ambiguous - would "root has no interactive password but has SSH keys" be acceptable? –  Andrew Jun 15 '10 at 22:59
    
Sorry I wasn't clear. Direct login as root via SSH is not permitted. –  Bryan M. Jun 16 '10 at 1:05
add comment

3 Answers

up vote 1 down vote accepted

you could:

  1. create a new group for data that should be read (by rsync), add UIDs to that group and/or change GIDs on files and directories and set appropriate permissions, that'll let you use rsync with that username
  2. get the exact command line run at the server end when using rsync-over-ssh (hint, use -v multiple times and remember to take the '-v's out of the command line you get) and use SSH public key authentication forcing that specific command (see AUTHORIZED_KEYS FILE FORMAT in sshd(8))

With #2 you could use rsync over ssh to the root user and still be secure (see PermitRootLogin no-password in sshd_config(5)), or even better you could combine the two to create a non-privileged user which can only be used with that specific rsync command line.

EDIT: sending auth data over ssh to get root (eg. ssh as user, sudo with user password) is not better than doing ssh directly to the root user (via public key or via a good password), IMHO.

share|improve this answer
add comment

You can specify what to run as the remote rsync command via --rsync-path - e.g. something like this:

rsync --rsync-path='sudo rsync' --blah --blah /src blah@dest:/dst

share|improve this answer
add comment

You can also use rsync daemon. Beware though, the way I described it there, makes it possible to access the module name by anyone on the machine running rsync daemon.

I haven't looked into it very deeply, but I wasn't able to create a secure public key based (and therefore passwordless) setup this way. But, there may be.

share|improve this answer
    
You can set the RSYNC_PASSWORD environment variable to pass the password to rsync non-interactively. ssh with keys is more secure IMO. –  James Jun 15 '10 at 20:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.