Here are my recommendations:
- Create a specific set of SSH public/private keys for this cron job. Use: ssh-keygen -t rsa -N '' -f id_cronjobname
- Protect the resulting id_cronjobname file such that only the cron job can read it. If this file is compromised, anyone with that keyfile can potentially gain the same privileges.
- Restrict the use of that key on the remote end. For example, in the remote authorized_keys, you may wish to prefix the key with the example below.
- Consider also using "from" to limit the IP address in the authorized_keys file. See "man sshd" for more information on these restrictions.
Example line from remote authorized_keys file:
no-pty,no-agent-forwarding,no-X11-forwarding,no-port-forwarding,command="rsync --server --sender -vlogDtprze.i --ignore-errors --numeric-ids --inplace . /path/on/destination/system" ssh-rsa SSH_KEY_STRING user@host"
The exact command to put in there you can get by running the rsync command you plan to use, and then at the same time on the remote system do "ps awwlx | grep rsync".
NOTE: One common problem I run into is that the use running the cron job does not have the remote host's SSH key, so it is trying to ask if the connection is ok. Make sure you place the remote system's SSH host key in /etc/ssh/ssh_known_hosts (probably just copy it out of your own ~/.ssh/known_hosts file after you have connected). Alternately, you can do "su - $USER_CRONJOB_RUNS_AS" and then manually invoke the command and make sure it works. Additionally, this is good for testing the job.