[Linux-disciples] Re: Rsyncing /etc

[Adam Rosi-Kessel]

On Wed, Jul 07, 2004 at 11:50:35PM -0400, Stephen R Laniel wrote:
> Forget it: it occurs to me that the only person who should
> be able to read the system backup is root, on either
> machine. So user slaniel shouldn't be involved in the sshing
> at any step. I created a key for root, and an
> authorized_keys file for root on the other end. Problem
> solved.

If you put the following in the authorized_keys file on root on the
target, you can limit what the preauthorized connection can do.  This is
good for damage control; if you have an unrestricted ssh key, someone who
gets root on one system automatically becomes root on the other.

This is the line I use for rdiff-backup:

command="rdiff-backup --server --restrict-read-only /",from="reverse.dns.on.IP.address.from.which.you.will.accept.connections",no-port-forwarding,no-X11-forwarding,no-pty ssh-dss AAAAB3Nz[...lots of other characters which is the public key on the first system...] root at storage 

I would recommend rdiff-backup over rsync in practically every case.  In
the example above, the "target" system is the one that is being backed
up, hence the --restrict-read-only.

The from= allows the key to be only be used from *one* source system.
this is another damage limiting factor.

If you really wanted to limit it to rsync rather than rdiff-backup, I
think you could just use rsync --server.

I think it's important to be careful when you're creating a potential
unrestricted root situation with no password.
-- 
Adam Rosi-Kessel
http://adam.rosi-kessel.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.bostoncoop.net/pipermail/linux-disciples/attachments/20040708/e303d4ab/attachment-0001.pgp