I definitely agree with Guillermo that passwordless root access is very risky. There are several ways to make it more secure, including the approach he describes. The same approach can be used to run as root locally should you wish to do so: you should ssh as a non-privileged user, then use sudo with command limitations to run a read-only rsync. But if you are just backing up user files, then it's even better to never run anything as root.
Craig On Mon, Mar 21, 2022 at 8:18 PM Guillermo Rozas <guille2...@gmail.com> wrote: > On Mon, Mar 21, 2022 at 11:40 PM <backu...@kosowsky.org> wrote: > >> > I would consider that configuration (SHH for root with a passwordless >> key) >> > a VERY VERY dangerous configuration. >> The poster is not saying no password, I think he/she is just saying >> use an unencrypted private ssh key... >> > > I understood the same, my point is that a passwordless private key for > root is still very dangerous unless that key is locked down in hell. > > >> There are some things you can do to *partially* harden the situation, >> While this might be particularly dangerous, but if you are going to backup >> a machine fully then you will need at least root-like read access to all >> the >> files on that machine. >> > > Agreed. But I would add these questions to the would-be-backupper: do you > really need to fully backup the machine, or is it just the easy way? Can > you (reasonably) break the backup in chunks that need access from a single > user each? > > Would be good to hear what others do here... > > > I only backup user files (and only for a few users/machines), so maybe it > is a corner case, but here you go: > > - I define a "host" for each user, using the ClientNameAlias to connect > multiple times to the same machine if needed. > - I then modify the RsyncSshArgs for each of these hosts to connect using > the corresponding username ($$sshPath -l user). > - Finally, on the clients the authorized_keys file has a "command=" part > included for the backup key that only allows to execute a modified version > of the rrsync script, with only read-only access to the root of the user's > folder to backup. > > Best regards, > Guillermo > _______________________________________________ > BackupPC-users mailing list > BackupPC-users@lists.sourceforge.net > List: https://lists.sourceforge.net/lists/listinfo/backuppc-users > Wiki: https://github.com/backuppc/backuppc/wiki > Project: https://backuppc.github.io/backuppc/ >
_______________________________________________ BackupPC-users mailing list BackupPC-users@lists.sourceforge.net List: https://lists.sourceforge.net/lists/listinfo/backuppc-users Wiki: https://github.com/backuppc/backuppc/wiki Project: https://backuppc.github.io/backuppc/
