0

I want to use unison to sync the /home directories between two EL6 boxes.

Most writeups assume that unison is run as root, and can ssh between the two boxes as root. However, we have disabled root logins in both /etc/passwd, as well as /etc/login.block. Connecting via ssh as root is disabled in sshd_config.

Is there a common and/or established method to unison sync something like /home without requiring root login?

One thought I had is to

  1. set up a uid:gid unison:unison on both boxes
  2. configure an ssh keypair for uid unison.
  3. set up unison/.ssh/authorized_keys so that only unison can be run from remote
  4. set up an acl on /home setfacl -R -m d:g:unison:rwx,g:unison:rwx /home
  5. set up the cronjob so it runs as uid 'unison'.

but I'm hoping that there's a better, more generally accepted way

Thanks!

1 Answer 1

1

What I usually do is to create role accounts.

  1. Create a role account (actually just another user, but we have a reserved uid-space for that) -- probably what you used with unison
  2. use ~unison/.ssh/authorized/keys with a restricting pattern like `force-command="/usr/local/bin/unison-homesync.sh"
  3. write /usr/local/bin/unison-homesync.sh
  4. use sudo for the required privileged actions

Pros:

  • There is no need for root to be able to login
  • sudo makes it easy to use privileged actions
  • writing a wrapper script makes it easy to be in a controled environment

Cons:

The approach does not scale well when done manually. If some configuration management is in place it is not a problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .