ssh catch 22

Ed lists at
Tue Nov 14 09:12:09 GMT 2006

I'll be honest, I was about to send a long mail on how it still doesn't 
work... when it suddenly did! :)

So I thought some poor soul might like a step by step so here it is is the source with the data you want is the destination where you want the data to go

with that in mind do:

1) on the destination, create an ssh key and export the public key to the 

2) edit the source authorized_keys where you put your pub key and add the 
following at the start of the key: 
from="",command="/usr/local/bin/" ssh-rsa AAAA...

2a) make sure your permissions are correct or it will never work

3) still on the source, edit /etc/ssh/sshd_config and make sure you can only 
log as root to execute a command:
AllowUsers foobar root at
PermitRootLogin forced-commands-only

3a) restart ssh

4) create the script with permissions 500
# cat /usr/local/bin/

# Validate rsync comming from a certificate

        echo "Rejected #1"
        echo "Rejected #2"
        echo "Rejected #3"
        echo "Rejected #4"
        echo "Rejected #5"
        echo "Rejected #6"
rsync\ --server*)
        echo "Rejected #7"

5) now on the destination server, you should be able to run the following 
command and not be prompted for a password.  I created a TEST file for the 
rsync -a -e "ssh -i /root/.ssh/rsync-key" root at .

Worked for me!

Thank you to wayne, David and Martin for helping me.


On Tuesday 14 November 2006 01:20, you wrote:
> On Tue, Nov 07, 2006 at 07:19:31PM +0100, Ed wrote:
> > b) in the certificate, I specified the command that could be run... the
> > likes of: "command="rsync -av ./source root at desthost:/destination"
> > ssh-rsa"
> It's completely invalid to specify a client command when expecting a
> server command.  Just run rsync with 2 -v options to see the command it
> it sending to the remote system, and will will tell you what command to
> expect.  See also the support/rrsync script thta can be used as the
> forced command=/path/rrsync script to limit the rsync command(s) that
> you accept.
> ..wayne..

More information about the rsync mailing list