Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm brainstorming ways that I can begin backing up my production servers' log files, config files, website data, mysql databases, etc.... as a non-root user to a separate off-site location.

The problem is this: For security reasons, I have the root user locked down so that root can never directly log into the production server. But in addition, the off-site physical server (in my home) is behind a dynamic IP address, so I can't do syslogging from production to backup in case my IP address changes.

What are you guys' thoughts on the best way to address this issue? 1 idea I had is this: Create a new user, called "backups" on the server, and give this user read-only access to everything (I need to backup) with setfacl:

setfacl -R -m g:backups:r-x /paths/to/directories

Then run rsync as the user "backups" from a cron of say, every 24 hours, on the machine where all of the backups will be stored. (Of course, log files would be backed up on a different cron, of say, every 5 minutes or so...)

Thoughts?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

But in addition, the off-site physical server (in my home) is behind a dynamic IP address, so I can't do syslogging from production to backup in case my IP address changes.

How about the dynamic DNS and port forwarding?

1 idea I had is this: Create a new user, called "backups" on the server, and give this user read-only access to everything (I need to backup) with setfacl

You'd better consider using a restricted shell with scponly or rssh.

$ ./configure --enable-rsync-compat
$ make
$ sudo make install
# echo /usr/local/bin/scponly >> /etc/shells
# sudo usermod -s /usr/local/bin/scponly backups
share|improve this answer
    
I held off on accepting this for a while, but I'm going to go ahead and do so now. I actually already have rssh installed on the server for other user access control, so I think that this is a good idea. Even though I haven't implemented it, the dynamic DNS / port forwarding idea isn't bad either. Thanks for taking the time to respond to this. –  David W Nov 23 '11 at 0:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.