Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently trying to figure out backing up using rsync - and I've run into a little hitch. I've disabled root access via SSH for security reasons, and have to use my special user account (without sudo permissions) whenever I SSH in to do admin bits. I then use "su -" to get full root access when I'm SSHd so that I can have full root access and can do all the special admin bits. I used to use the following for backing up from my local machine:

sudo rsync -rav root@MyServerIP:/ BackupFolder/

However with my new security measures in place (not being able to SSH with root), I cannot use this. And since my special user account doesn't have sudo permissions - I can't use him to rsync either.

How can I run the command I've written above, after a "su -" or some other trick to make it have the permissions to do this? (I can input the root password to get root access - however root cannot be logged in directly from SSH)

share|improve this question
You are backing up to local machine, right.? why don't you consider using ssh-key for root rather than pass + su ? – SparX Sep 26 '11 at 19:15
It seems surprising that su would be allowed but sudo would not. Interesting. – mdpc Sep 26 '11 at 19:25
actually you setup passwordless key authentication for root itself and use root when doing rsync. – SparX Sep 26 '11 at 19:57
Right - but can I do this while disabling root SSH via password? – joesavage Sep 26 '11 at 20:20
Ofcourse, yes. You need to set "PermitRootLogin without-password" which will only allow root login using appropriate ssh-key. All password authentication requests will be denied for user root. – SparX Sep 26 '11 at 23:01
up vote 3 down vote accepted

Your backup jobs should be configured as "push" jobs rather than "pull". Initiate the backup job via root's cron on your server, and have it rsync its files to the backup destination.

share|improve this answer
But even with the IP of my Mac Mini, how can I tell my Mac Mini to accept the files that the server is sending to it? – joesavage Sep 26 '11 at 19:14
Configure port forwarding on your router. – EEAA Sep 26 '11 at 19:14
Would it be this simple? What ports would I need to forward? – joesavage Sep 26 '11 at 19:32
You'd need to forward whatever port ssh is listening on, probably 22/tcp. There are some security ramifications of doing this, though, and you sound like you're already out of your depth, so be careful, and make sure you do your homework before making this change. – EEAA Sep 26 '11 at 19:54
Right - so it's probably best I don't do this in interests of my security. Is there any easy way to tar.gz up everything while on the server (as root thanks to "su -")? Then I could just chmod the tar.gz to be accessible by my special user and then to rsync over the tar.gz – joesavage Sep 26 '11 at 20:01

Suggested to use ssh-key authentication with rsync, after setting "PermitRootLogin without-password" in the ssh configuration to allow root access only via key authentication.

Just adding as the answer since you requested:)

share|improve this answer

You could run an rsync server on the other computer. You can specify permitted users.

share|improve this answer

You can execute sudo on the remote host using the --rsync-path option. Something like this:

rsync -rav --rsync-path='sudo rsync' root@MyServerIP:/ BackupFolder/

Essentially, this causes rsync on the remote box to run as root.

share|improve this answer
This would work if my special account had admin privileges - however it has not (I need to use "su -" on it to become root to do anything). – joesavage Sep 27 '11 at 6:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.