I want to use rsync to take automated backups from a remote webserver over ssh. The webserver is configured with suphp, so different sites have files with different users and groups. Unfortunately a web application generates some files without group or other read permissions.

I can only see two options, neither of which are palatable; either run rsync as root or allow ssh access for each web user and run rsync as each web user in turn.

Unfortunately ACLs wont work because when files are created by the webserver with 600 permissions, this adjust the inherited ACL mask to make the effective permissions for other users 000.

Can anyone suggest a way of running rsync with the lowest possilbe privileges that still allow access to user files which don't have group or other read permissions.



I've got a solution by turning the problem on its head. Instead of pulling the data from the production machine to the backup machine, I'm pushing the data from production to backup.

This way I only have to run rsync as the PHP user on the production machine and as the backup user on the backup machine. The ssh authorized keys file for the backup user allows me to further lock down access by production server IP and also limit the commands which can be run rsync.

  • This is the way to do it. Always have instructions go from high security zones (eg, production web servers) to low-security zones (eg, backup servers). – MadHatter Nov 30 '15 at 13:12

I can see 3 leads, none of them is really simple.

  • You can use rsync without ssh, in a vpn or ssl tunnel, so that the rsync process would be quite limited, with a read-only share.

  • You could run a read-only bind-mount of your data, and use rsync/ssh data in there.

  • Using capabilities http://linux.die.net/man/7/capabilities, especially CAP_DAC_READ_SEARCH your unprivileged process should be able to read everything. To change capabilities for rsync, I would use http://linux.die.net/man/8/setcap.

  • 1
    Setting that capability on rsync would let anybody who can run rsync read anyone else's files. Probably not a good idea. And SELinux will complain if you try to run rsync this way anyway. – Michael Hampton Nov 28 '15 at 16:08

The clean solution based on capabilities is described here: https://blog.night-shade.org.uk/2015/04/linux-capabilities-and-rsync-from-presentation-to-practice/

EDIT: details of the solution. Capabilities are composed of a combination of process capabilities, inherited between processes, and set initially by PAM, and file capabilities, set on executables. To give full read access to user 'backup' when using rsync:

-- add a line in /etc/security/capability.conf with

cap_dac_read_search backup

to give cap_dac_read_search (read any file without beeing root) to user backup. It will enable the capability only when using an executable with the same capability set as inheritted (and 'effective' bit to have it implictely enabled).

-- set effective and inherit capability on file /usr/bin/rsync with command:

setcap cap_dac_read_search+ei /usr/bin/rsync

It gives the capability to read all content only to given user when using the given binary (and not to anyone else using the same binary)

  • Link-only answers are discouraged here - could you provide the relevant content from your link in your answer please? – BE77Y May 25 '16 at 15:12
  • Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Jenny D May 25 '16 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.