Forcing a transfer to be one-way from the daemon side?

Kyle Lanclos lanclos at
Wed May 7 16:31:11 GMT 2008

danm at wrote:
> I'm trying to set up a secure way to back up a system as root, with rsync 
> (assume we don't want to kill the bandwidth and want a "snapshot" system 
> for developers in a way that makes dump, tar, etc impractical.
> We've got an ssh key relationship set up and we can force the command to 
> be rsync --daemon.

I set up a similar system, except that I used an ssh agent rather than a
simple key relationship. I hope this diagram makes sense:

\  \
 \  \-> authorized_keys includes
   \-> ssh-agent
        \  \
         \  \-> server_id_dsa attached
           \--> ssh to client machine
	              / \
                     /   \-> authorized_keys includes,
  rsync to server <-/                        which only runs rsync script

This way, the client machine can only rsync back data when the ssh agent
is present, because the server only allows in connections for its *own*
key, not any key that is stored on the client filesystem.

If you want to make this somewhat more secure, set it up in such a way
that the client machine cannot write to the rsync script-- in our case,
the client machines access the rsync script from a read-only nfs partition.


More information about the rsync mailing list