1

I want to use rsync to take automated backups from a remote webserver over ssh. The webserver is configured with suphp, so different sites have files with different users and groups. Unfortunately a web application generates some files without group or other read permissions.

I can only see two options, neither of which are palatable; either run rsync as root or allow ssh access for each web user and run rsync as each web user in turn.

Unfortunately ACLs wont work because when files are created by the webserver with 600 permissions, this adjust the inherited ACL mask to make the effective permissions for other users 000.

Can anyone suggest a way of running rsync with the lowest possilbe privileges that still allow access to user files which don't have group or other read permissions.

Thanks

3 Answers 3

3

I've got a solution by turning the problem on its head. Instead of pulling the data from the production machine to the backup machine, I'm pushing the data from production to backup.

This way I only have to run rsync as the PHP user on the production machine and as the backup user on the backup machine. The ssh authorized keys file for the backup user allows me to further lock down access by production server IP and also limit the commands which can be run rsync.

1
  • This is the way to do it. Always have instructions go from high security zones (eg, production web servers) to low-security zones (eg, backup servers).
    – MadHatter
    Commented Nov 30, 2015 at 13:12
1

I can see 3 leads, none of them is really simple.

  • You can use rsync without ssh, in a vpn or ssl tunnel, so that the rsync process would be quite limited, with a read-only share.

  • You could run a read-only bind-mount of your data, and use rsync/ssh data in there.

  • Using capabilities http://linux.die.net/man/7/capabilities, especially CAP_DAC_READ_SEARCH your unprivileged process should be able to read everything. To change capabilities for rsync, I would use http://linux.die.net/man/8/setcap.

2
  • 1
    Setting that capability on rsync would let anybody who can run rsync read anyone else's files. Probably not a good idea. And SELinux will complain if you try to run rsync this way anyway. Commented Nov 28, 2015 at 16:08
  • @MichaelHampton you can create a copy of rsync in /home/readuser/bin/rsync and chmod 700 it Commented Jan 3, 2022 at 0:56
1

The clean solution based on capabilities is described here: https://blog.night-shade.org.uk/2015/04/linux-capabilities-and-rsync-from-presentation-to-practice/

EDIT: details of the solution. Capabilities are composed of a combination of process capabilities, inherited between processes, and set initially by PAM, and file capabilities, set on executables. To give full read access to user 'backup' when using rsync:

-- add a line in /etc/security/capability.conf with

cap_dac_read_search backup

to give cap_dac_read_search (read any file without beeing root) to user backup. It will enable the capability only when using an executable with the same capability set as inheritted (and 'effective' bit to have it implictely enabled).

-- set effective and inherit capability on file /usr/bin/rsync with command:

setcap cap_dac_read_search+ei /usr/bin/rsync

It gives the capability to read all content only to given user when using the given binary (and not to anyone else using the same binary)

2
  • Link-only answers are discouraged here - could you provide the relevant content from your link in your answer please?
    – BE77Y
    Commented May 25, 2016 at 15:12
  • Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – Jenny D
    Commented May 25, 2016 at 16:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .