I want a backup host to be able to pull backups from a remote host.

The backup host uses ssh key authentication to authenticate as a restricted user on the remote host, this user is restricted to the rsync command using the authorized_key file.

/etc/sudoers allows the user to execute rsync as superuser.

The backup host should logically only be able to read files / copy files from the remote host, not write files / copy files to the remote host, as it could easily compromise the remote host by overwriting /etc/passwd or just tamper with the files if it were compromised itself.

How can I achieve this? I already read about rrsync, but didn't see an option which allowed this.


Have a look at authprogs - I was using it for a quite similar scenario (backuppc via ssh)


The -ro flag of rrsync ensures that rsync is called with the --sender option, which should, according to the rrsync documentation, ensure that files can only be read - however, I could not find a authoritive source (aka rsync documentation) which confirms that. In my tests, it was sufficient to prevent writes to the server.


This is close to necromancing, but still I found this question first and feel this is incomplete, because it relies on external programs.

So in pull mode, on the receiver's side, the read-only mode presupposes trust though. As a backup method above commands might work well as long as only the properly configured client requests the data. If you want to restrict what rsync over ssh can do one remote setting ro client side may not be enough.

If you have access to the server the data is being pulled from over SSH there is some simple extra configuration to be done to restrict what the logged in user can do. SSH, used with a public and a private key, offers this additional way of ensuring the client can call a specific command only.

This is how its done. On the server, where the data is being pulled from, there is a ~/.ssh/known_hosts file in user's home directory. The file holds one line per host that it knows the pubkey of, like this

ssh-dss AAAAB3....o9M9qz4xqGCqGXoJw= user@host

Prefix that with the command you wanat to allow

command="/bin/myscript.sh",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-dss AAAAB3....o9M9qz4xqGCqGXoJw= user@host

to have it such that user@host can only execute /bin/myscript.sh on remote.

A related question with good answers is over at the SO site.

New contributor
raddaqii is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.