<div dir="ltr">I'm aware of rrsync, and it works well for its use case.<div><br></div><div>We use authprogs for more than just rsync though, and want more granularity than rrsync can support. If you force rrsync for the ssh key via <font face="monospace">command="rrsync"</font> then that key may only be used to run rsync, you can't also allow additional commands. From a CI/CD perspective it may be useful to have the client side rsync some files, restart some services, and not need to use separate keys for each.</div><div><br></div><div>Additionally, we'd like to be able to limit some of the feature flags (e.g. allow/disallow links), or support multiple paths (/opt/pkgs/somedir/ and /srv/someotherdir) without making separate ssh identities and <font face="monospace">authorized_keys</font> entries for each.</div><div><br></div><div><br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Feb 18, 2021 at 9:22 AM Kevin Korb via rsync <<a href="mailto:rsync@lists.samba.org">rsync@lists.samba.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">You should both look into rrsync. It comes with rsync and is designed<br>
to do exactly this. Unfortunately some Linux distros are maintained by<br>
insane people who install rrsync as if it was documentation (compressed<br>
and not executable) instead of a helper script which is what it is.<br>
<br>
On 2/18/21 10:28 AM, Karl O. Pinc via rsync wrote:<br>
> On Wed, 17 Feb 2021 21:52:06 -0800<br>
> Bri Hatch via rsync <<a href="mailto:rsync@lists.samba.org" target="_blank">rsync@lists.samba.org</a>> wrote:<br>
> <br>
>> I recently added initial rsync support to authprogs.<br>
> <br>
>> I'd be very interested in feedback <br>
> <br>
> For some 15 years+ (?) I've had a /root/.ssh/authorized keys line<br>
> that starts with:<br>
> <br>
> "no-pty,no-agent-forwarding,no-port-forwarding,no-user-rc,no-X11-forwarding,command="rsync --server --daemon ."<br>
> <br>
> Occasionally I frob the ssh restrictions as new ones are<br>
> introduced.<br>
> <br>
> The remote end uses rsync to backup (with --link-dest) the<br>
> entire file system. The idea (iirc) was to restrict<br>
> the given key so that it would only run rsync.<br>
> And I think this also forces the local end to use<br>
> /etc/rsyncd.conf, where there's an additional layer<br>
> of security via a secrets file and read-only can<br>
> be set to provide some control.<br>
> <br>
> The remote end always runs rsync -- the direction of <br>
> transfer is static, per-host-pair, but can be either<br>
> in or out. (Push or pull backups.) The above authorized_keys <br>
> line does not enforce direction, which might be useful.<br>
> <br>
> I only rarely think about tweaking the authorized_keys line, <br>
> and the rsync options used haven't changed since I got them to work.<br>
> Without really thinking about it it seems that your<br>
> authprogs development might be useful. <br>
> <br>
> My purpose with this email is to let you do all the <br>
> thinking and tell me of all the wonderful utility<br>
> your authprogs work can provides, either now or<br>
> in the future. ;-) Or at least give you some<br>
> background in case you want to develop in a direction<br>
> that you think would helpful to me. If something comes<br>
> of this I might even turn my brain on again and<br>
> modify my systems. :)<br>
> <br>
> Regards,<br>
> <br>
> Karl <<a href="mailto:kop@karlpinc.com" target="_blank">kop@karlpinc.com</a>><br>
> Free Software: "You don't pay back, you pay forward."<br>
> -- Robert A. Heinlein<br>
> <br>
<br>
-- <br>
~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,<br>
Kevin Korb Phone: (407) 252-6853<br>
Systems Administrator Internet:<br>
FutureQuest, Inc. Kevin@FutureQuest.net (work)<br>
Orlando, Florida <a href="mailto:kmk@sanitarium.net" target="_blank">kmk@sanitarium.net</a> (personal)<br>
Web page: <a href="https://sanitarium.net/" rel="noreferrer" target="_blank">https://sanitarium.net/</a><br>
PGP public key available on web site.<br>
~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,<br>
<br>
-- <br>
Please use reply-all for most replies to avoid omitting the mailing list.<br>
To unsubscribe or change options: <a href="https://lists.samba.org/mailman/listinfo/rsync" rel="noreferrer" target="_blank">https://lists.samba.org/mailman/listinfo/rsync</a><br>
Before posting, read: <a href="http://www.catb.org/~esr/faqs/smart-questions.html" rel="noreferrer" target="_blank">http://www.catb.org/~esr/faqs/smart-questions.html</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><span style="font-size:12.8px">Bri Hatch, Systems and Security Engineer. <a href="http://www.ifokr.org/bri/" target="_blank">http://www.ifokr.org/bri/</a></span><br></div><div><br></div><div>The sooner you fall behind, the more time you'll have to catch up.</div><div><br></div></div></div>