Rsync with ssh-keygen to ssh user with limited commands and specifc directory

Question

i have two machines

• local machine
• remote machine

i want to backup my files and folders automatically to the remote machine and doing that by Rsync command for transfer files and folder using ssh-keygen for automatically login to the remote machine

i can do it as ssh root but that will be a bit of security risk if someone can login directly to the remote machine as root if the local files has been compromised

i tried rssh but i couldn't try to login automatically using ssh-keygen

what iam looking for is how to create a ssh user with limited shell commands and specific directory safe for automatically login with no harm to the remote machine

Answer 1

You can limit the command run when using a ssh key-pair by using command="...." into ~/.ssh/authorized_keys file. Example took from here:

$ cat ~/.ssh/authorized_keys 
command="/usr/local/bin/rsync --server -vlogDtprz --delete . /tmp",no-pty,no-agent-forwarding,no-port-forwarding ssh-rsa AAAAB3NzaC1y[...] kattoo@spaghetti

Answer 2

rsync includes a rrsync example script that can restrict rsync.

Example:

command="/usr/local/bin/rrsync -ro /data",no-port-forwarding,no-X11-forwarding,no-pty ssh-rsa [...]

That way you don't have to hardcode the commandline from the client on the server.

Answer 3

We use rsnapshot with combination of keychain and validating script following this guide: http://www.tarfu.se/hacking/35/46