Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm currently trying to figure out backing up using rsync - and I've run into a little hitch. I've disabled root access via SSH for security reasons, and have to use my special user account (without sudo permissions) whenever I SSH in to do admin bits. I then use "su -" to get full root access when I'm SSHd so that I can have full root access and can do all the special admin bits. I used to use the following for backing up from my local machine:

sudo rsync -rav root@MyServerIP:/ BackupFolder/

However with my new security measures in place (not being able to SSH with root), I cannot use this. And since my special user account doesn't have sudo permissions - I can't use him to rsync either.

How can I run the command I've written above, after a "su -" or some other trick to make it have the permissions to do this? (I can input the root password to get root access - however root cannot be logged in directly from SSH)

share|improve this question
    
You are backing up to local machine, right.? why don't you consider using ssh-key for root rather than pass + su ? –  SparX Sep 26 '11 at 19:15
    
It seems surprising that su would be allowed but sudo would not. Interesting. –  mdpc Sep 26 '11 at 19:25
    
Using an ssh-key sounds great, but then what user would I put in the rsync command? (Plus - I have no clue how to do ssh-keys, I'm a Linux noob :P) –  joesavage Sep 26 '11 at 19:33
1  
actually you setup passwordless key authentication for root itself and use root when doing rsync. –  SparX Sep 26 '11 at 19:57
    
Right - but can I do this while disabling root SSH via password? –  joesavage Sep 26 '11 at 20:20
show 2 more comments

4 Answers

up vote 2 down vote accepted

Suggested to use ssh-key authentication with rsync, after setting "PermitRootLogin without-password" in the ssh configuration to allow root access only via key authentication.

Just adding as the answer since you requested:)

share|improve this answer
add comment

Your backup jobs should be configured as "push" jobs rather than "pull". Initiate the backup job via root's cron on your server, and have it rsync its files to the backup destination.

share|improve this answer
    
But even with the IP of my Mac Mini, how can I tell my Mac Mini to accept the files that the server is sending to it? –  joesavage Sep 26 '11 at 19:14
    
Configure port forwarding on your router. –  EEAA Sep 26 '11 at 19:14
    
Would it be this simple? What ports would I need to forward? –  joesavage Sep 26 '11 at 19:32
1  
You'd need to forward whatever port ssh is listening on, probably 22/tcp. There are some security ramifications of doing this, though, and you sound like you're already out of your depth, so be careful, and make sure you do your homework before making this change. –  EEAA Sep 26 '11 at 19:54
    
Right - so it's probably best I don't do this in interests of my security. Is there any easy way to tar.gz up everything while on the server (as root thanks to "su -")? Then I could just chmod the tar.gz to be accessible by my special user and then to rsync over the tar.gz –  joesavage Sep 26 '11 at 20:01
show 3 more comments

You could run an rsync server on the other computer. You can specify permitted users.

share|improve this answer
    
You can? Awesome! Are there any "easy" instructions to set this up? That documentation is intimidating for a Linux newbie like me.. –  joesavage Sep 26 '11 at 19:38
add comment

You can execute sudo on the remote host using the --rsync-path option. Something like this:

rsync -rav --rsync-path='sudo rsync' root@MyServerIP:/ BackupFolder/

Essentially, this causes rsync on the remote box to run as root.

share|improve this answer
    
This would work if my special account had admin privileges - however it has not (I need to use "su -" on it to become root to do anything). –  joesavage Sep 27 '11 at 6:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.