Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to automatically mirror a large amount (terabytes) of files in two unix machines over a slow link (1 Mbps). This needs to be done frequently, but the data doesn't change too much (delta transmission doesn't saturate the link).

The usual solution would be rsync, but there's an additional requirement: it's undesirable, from a security standpoint, that either the source or destination machines have (keyless) ssh keys to each other, or any kind of filesystem access. All communication between the two machines should thus be initialized (and mediated) through a third machine.

I've asked a separate question about rsync in particular here. Are there other obvious solutions I'm missing?

share|improve this question
add comment

1 Answer 1

Not exactly what you are asking. But just in case...

You can easily authorize a specific ssh key to only be allowed to run certain commands on the remote machine (this is similar to how gitosis and gitolite and possibly any other secure git-over-ssh implementations work). Long story short, add these options to the destination users's authorized_keys file:

  • command="/path/to/validation/script"
  • no-port-forwarding
  • no-X11-forwarding
  • no-agent-forwarding
  • no-pty

The file should look like this in the end:

command="/path/to/validation/script",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2E.....

The no-* options are self explanatory.

The command= option runs a "forced" command "ignoring any command supplied by the client". The command originally supplied by the client is available in the SSH_ORIGINAL_COMMAND environment variable" (somewhat quoted from the sshd man page). In other words when someone logs in with that key, the only command that will be run is the validation script. It is up to you to allow them to run it or not. So, your validation script can do something like:

#!/bin/bash
if [[ $SSH_ORIGINAL_COMMAND == rsync --server -vtr --delete /source/path/ /destination/path/ ]]; then
     $SSH_ORIGINAL_COMMAND
end

And due to the other no- options, this key is not allowed to do anything else too harmful.

Update: There is a ready-made script that simplifies this configuration a little. -- Mikko

share|improve this answer
    
It's difficult to apply this here since there's so many potentially harmful command combinations, but this is still very useful, since I've been using rssh for this purpose, and this is much more flexible. Thanks for the tip! –  goncalopp Nov 18 '12 at 4:57
    
1) Updated the answer with a few more hints when securing this way. 2) And exactly because there are so many potentially harmful combinations this method is quite safe. If your rsync clients always run the same command you can ensure that they only run that one command and absolutely nothing else. 3) By the way, at my place we use jailkit (jk_lsh) + built-in chroot support in openssh. I personally find it more flexible. –  chutz Nov 18 '12 at 15:51
1  
There is a ready-made script available that simplifies this configuration a little: ftp.samba.org/pub/unpacked/rsync/support/rrsync. See the comments for usage examples. –  Mikko Nov 19 '12 at 9:47
    
@Mikko, thanks. I put the link in the answer so more people can see it. –  chutz Nov 19 '12 at 10:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.