As a poor man's protection, when backing up Linux hosts, I avoid
ssh'ing into root@remotehost and instead ssh into a non-admin user
backupp-remote and then use /etc/sudoer to limit the superuser reach
to /usr/bin/rsync with selected flags. Of course, this still leaves
security holes to a malicious hacker but it does create some
restrictions.
In my config file, I use:
$Conf{RsyncClientPath} = '/usr/bin/sudo /usr/bin/rsync';
$Conf{RsyncSshArgs} = ['-e', '$sshPath -l backuppc-remote'];
#Note: above kluge generates rsync statement on the *remote* host of form:
# /usr/bin/ssh -l backuppc-remote <host> /usr/bin/sudo /usr/bin/rsync
--server --sender -slHogDtpAXrcxe.iLsf --iconv=UTF-8
In my /etc/sudoers file, I use:
#: BackupPC
#: Don't require tty for backuppc, backuppc-remote
Defaults:backuppc,backuppc-remote !requiretty
#: Allow user backuppc & backuppc-remote to run sudo rsync to avoid need for
ssh root@localhost:
#: Note for rsync < 3.1.x, string to sender can be either:
-slHogDtpAXrcxe.iLsf (full) or -slHogDtpAXrxe.iLsf (incremental)
backuppc,backuppc-remote ALL=NOPASSWD: /usr/bin/rsync --server
--sender -slHogDtpAXrxe.iLsf, /usr/bin/rsync --server --sender
-slHogDtpAXrcxe.iLsf
#: Note for rsync >= 3.1.x, string to sender can be either:
-slHogDtpAXrcxe.iLsfxC (full) or -slHogDtpAXrxe.iLsfxC (incremental)
backuppc,backuppc-remote ALL=NOPASSWD: /usr/bin/rsync --server
--sender -slHogDtpAXrxe.iLsfxC, /usr/bin/rsync --server --sender
-slHogDtpAXrcxe.iLsfxC
And my passwd file is setup as follows:
backuppc-remote:x:1200:1200:Backuppc user for remotely backing up this
host:/home/backuppc-remote:/bin/sh
Felix Wolters wrote at about 17:14:43 +0100 on Wednesday, February 10, 2021:
> Just to clarify: My question is about using rrsync on the remote client
> to protect it (as I explained) from a potentially currupted server.
> Obviously, the standard rrsync isn’t compatible with rsync-bpc. So I’m
> curious about Guillermo’s adjusted version of rrsync!
>
> What I did got so far:
>
> * BackupPC works without any problem with standard rsync on client
> side (i.e. without restriction to the specific ssh-key).
> * The BackupPC-user on the server can sync using standard rsync (done
> manually via terminal – not rsync-bpc) with rrsync set up on the
> client (put rrsync as forced command in front of the specific server
> key in authorized_keys).
> * Though, BackupPC won’t work within the same setup with rrsync forced
> on the client. (Error log says only: "Got fatal error during xfer
> (No files dumped for share …)"
>
> Greetings
>
> Am 10.02.21 um 15:45 schrieb [email protected]:
> > Adam Goryachev via BackupPC-users wrote at about 23:53:38 +1100 on
> > Wednesday, February 10, 2021:
> > >
> > > On 10/2/21 02:56, Felix Wolters wrote:
> > > > Hello!
> > > >
> > > > Let me first thank you for providing BackupPC as open source
> > software. I
> > > > appreciate it a lot and consider it to be one of the most usefull
> > backup
> > > > systems out there!
> > > >
> > > > I’d like to use it with restricted access to the client, so a
> > > > potentially corrupted BackupPC server wouldn’t be able to damage the
> > > > client machine and data. Using rsync for transfer with a Linux client,
> > > > rrsync (restricted rsync – as part of the rsync package) would be a
> > > > straigt forward solution to restrict an incoming ssh connection to
> > only
> > > > rsync and only a given folder which I will set read only – which would
> > > > perfectly do the trick. Unfortunately, this doesn’t seem to work with
> > > > BackupPC over rsync, as far as I can see. I’m positive rrsync
> > generally
> > > > works on the client as I use it successfully with plain rsync over ssh
> > > > on the same machine.
> > > >
> > > > I’ve seen rare information on the internet about this, and it wouldn’t
> > > > help me so far.
> > > >
> > > > Thank you for some help or instruction!
> > >
> > > Hi Felix,
> > >
> > > I'm not familiar with rrsync, but perhaps the first step would be to
> > try
> > > it and see. If it doesn't work, then include some logs and what debug
> > > steps you have taken, or other information that might help us to help
> > you.
> > >
> > > Regards,
> > > Adam
> >
> > I think it depends if 'rrsync' needs to run on the client or server
> > sides.
> > - If it runs on the (remote) client side and is compatible with backuppc
> > protocols then it may work.
> >
> > - If it runs on the (local) server side then there is no hope for it
> > to work as backuppc uses its own patched version of rsync, called
> > rsync-bpc.
> >
> >
> >
> > _______________________________________________
> > BackupPC-users mailing list
> > [email protected]
> > List: https://lists.sourceforge.net/lists/listinfo/backuppc-users
> > Wiki: https://github.com/backuppc/backuppc/wiki
> > Project: https://backuppc.github.io/backuppc/
> _______________________________________________
> BackupPC-users mailing list
> [email protected]
> List: https://lists.sourceforge.net/lists/listinfo/backuppc-users
> Wiki: https://github.com/backuppc/backuppc/wiki
> Project: https://backuppc.github.io/backuppc/
_______________________________________________
BackupPC-users mailing list
[email protected]
List: https://lists.sourceforge.net/lists/listinfo/backuppc-users
Wiki: https://github.com/backuppc/backuppc/wiki
Project: https://backuppc.github.io/backuppc/
