Reasonably secure automated rsync backups
Posted by Graham Stratton Mon, 12 Feb 2007 15:13:30 GMT
Rsync is one of those wondrous unix utilities that it’s difficult to imagine a world without. Amongst many other uses, it’s a really good way to do daily backups.
Using SSH, rsync is secure too. But for automated access it’s a bit tricky. In order to do automated backups, one needs to set up some sort of passwordless login. This is done by generating an RSA key pair on machine A, and copying the public key to machine B. Now when A tries to log in to B, B has a way to test that A really is A. Cool. But that means that A being compromised leads trivally to B being compromised.
The solution is to limit the range of commands that A can execute on B using a particular SSH key. One can limit it to a single command by prefixing a line of authorized_keys like this:
command="/bin/echo You may not do anything useful"
Now whatever command is sent, this is the command that will be executed.
More about restricting SSH is available in chapter 8 of O’Reilly’s book at http://www.oreilly.com/catalog/sshtdg/chapter/ch08.html There are a number of other useful options such as no-port-forwarding, no-X11-forwarding, no-agent-forwarding and no-pty – don’t forget options should be separated by commas but no whitespace.
So it’s quite easy to ensure that only a single command is run. But it’s not so easy if you don’t know exactly what the command will be, as with rsync. In this case, the trick is to run a script which decides whether the original command is permissible. The requested command is available as the environment variable $SSH_ORIGINAL_COMMAND (or $SSH2_ORIGINAL_COMMAND if you’re using SSH2, I believe).
There is a useful script here: http://servers.linux.com/article.pl?sid=04/11/04/0346256 It checks that the command doesn’t contain ; or & characters (ie, there is only one command, and that it begins with ‘rsync—server’. If the command matches, it runs it, otherwise it rejects it. This means that you can’t do anything else with the key you are using for backups (which is good). But what if you want an SSH identity that you can use for manual logins, which is password protected and stored in your keychain? Easy enough, just create to RSA keys.
To specify which key ssh should use, use the -i option:
rsync -e "ssh -i .ssh/id_rsa_backup" --recursive -L /home/graham/tobackup/* back.up/server/
