Linux – Restrict rsync over ssh read only / only copy from remote host

backuplinuxrsync

I want a backup host to be able to pull backups from a remote host.

The backup host uses ssh key authentication to authenticate as a restricted user on the remote host, this user is restricted to the rsync command using the authorized_key file.

/etc/sudoers allows the user to execute rsync as superuser.

The backup host should logically only be able to read files / copy files from the remote host, not write files / copy files to the remote host, as it could easily compromise the remote host by overwriting /etc/passwd or just tamper with the files if it were compromised itself.

How can I achieve this? I already read about rrsync, but didn't see an option which allowed this.

Best Answer

The -ro flag of rrsync ensures that rsync is called with the --sender option, which should, according to the rrsync documentation, ensure that files can only be read - however, I could not find a authoritive source (aka rsync documentation) which confirms that. In my tests, it was sufficient to prevent writes to the server.

Related Topic