I have root ssh logins disabled on my server, but I currently want to back up some files owned by root onto my my local box.

I am trying to figure out a way to use SCP to retrieve files while logged in via SSH without running a ssh daemon on my local box - and without installing any additional tools.

Just wondering if this is possible? I don't think it is..

The only method I can think of is to run a script that logs in via a user account then su's to root, then copies -- but I am trying to avoid this because I don't wish to hardcode my root pw into a script file on my local machine.

  • A side note; personally, and that might scorn a lot of people, I think root logins aren't that dangerous to allow, provided the password isn't r00t, root123, or even I4ml33t. – Halfgaar Jun 19 '12 at 22:18
  • If you want to go old-school really hacky, then how about xmodem/zmodem? Or simply export the file to stdout using base64 encoding. Capture it in your terminal log on the client, and then decode. – Zoredache Jun 19 '12 at 22:54

You can do what you want with a combination of rsync, ssh, and sudo.

If you add a local user to your machine "privileged" you can then allow that user to run rsync via sudo. Which will allow you to remotely fetch files only readable by root to your local system.

# Our backup client needs to rsync in a privileged manner.
privileged  ALL  = NOPASSWD: /usr/bin/rsync

Once you have that in place you can run something like this to fetch files:

rsync --rsync-path="sudo rsync" privileged@host.to.backup:/root /backup_directory
  • Is that first bit meant to go into an rysnc config file? – bMon Jun 19 '12 at 22:42
  • Would that allow anyone to 'hack' the unprivileged access account and then be able to read all the files off the server? – EightBitTony Jun 19 '12 at 22:42
  • 1
    No, it goes in the /etc/sudoers (which you should only edit with visudo) – EightBitTony Jun 19 '12 at 22:43
  • No nano for /etc/sudoers? Why not, just curious.. – bMon Jun 19 '12 at 22:46
  • @EightBitTony: It does mean that if the password/ssh key to that user is compromised any files may be read/written to as root, yes. Obviously you should further restrict things e.g. limit remote access to a known-good single IP, via ~privileged/.ssh/authorized_keys etc. – user9565 Jun 19 '12 at 22:46

Enable root login on the server, but restrict them to passkey only. Set up a key pair on your local box, put the public key in root's authorized_keys file on the server and off you go.

This is 99.9999% as secure as not allowing root logins, as long as you protect the keypair from theft.

If you set up a complex pass phrase on the key, then you'll need to be present to run the backups, or use ssh-agent or something similar. Or, you could just not put a pass phrase on the key and you now have magic, passwordless access to your server via root. Obviously, in that instance theft of the private key is a more serious issue, so you need to understand those risks and either mitigate them, or use a strong pass phrase.

I know this isn't quite what you asked for, but honestly, passkey protected root logins are safe (with the caveat that you should keep up-to-date on sshd patches).

Any other option that allows any user ID enough permissions on the target server to be root, without putting them behind a passkey protected ssh login is actually less secure, than just allowing root via passkey only.

If your local workstation has a predictable IP address you can make this even more secure using the AllowUsers option.


AllowUsers root@

  • I do this for my back up accounts, but wish to keep root logins (pw and keys) disabled, at this time. Moral of the story I can't do what my question asks..correct? – bMon Jun 19 '12 at 22:24
  • You may be able to, someone might offer a suggestion, I'm just saying I don't see the point of permanently disabling root login, when there's a perfectly secure way of handling them. – EightBitTony Jun 19 '12 at 22:26
  • I get it, and I knew this was going to be the response via SF, but just wanted to know about my specific question. And no, IP from local would be dynamic. – bMon Jun 19 '12 at 22:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.