How to manage root<-->root rsync keeping permissions?

Chris Green cl at isbd.net
Sat Aug 7 15:45:20 UTC 2021


On Sat, Aug 07, 2021 at 08:10:47AM -0700, L A Walsh wrote:
> On 2021/08/07 03:44, Chris Green via rsync wrote:
> > L A Walsh via rsync <rsync at lists.samba.org> wrote:
> > > It seems to me, a safer bet would be to generate an ssh-cert
> > > that allows a passwdless login from your sys to the remote.
> > > 
> > The trouble with that is that it leaves a big security hole.
> ----
> 
>    If you only do backups at 1am (or whenever), why would your
> backup machine enable ssh outside of the range 12:59 - 01:01?
> 
Because cron/anacron isn't perfect and the machine being backed up nay
not be turned on all the time so the time that it tries to backup is
most definitely not fixed accurately!


> > 
> > If (for example) I leave my laptop turned on somewhere, or someone
> > wanders into my study where my desktop machine is they have instant,
> > passwordless access to the remote backup machine.
> ----
>    If your desktop machine is that open to casual wanderers, perhaps
> you should enable a passwd locked screen saver activating after a few
> minutes?  I keep my home computer unlocked all the time as well, but I
> don't have walk-through visitors that might mess with it.
> 
Neither do I, though we do have family and friends around the place
quite a lot.  I agree, in general, my desktop machine isn't
particularly accessible or vulnerable but it *might* get hacked or
accessed by an intruder and I thus try my best to protect the backup
machine from it.

> > I try very hard to make my backups secure from attack so that if my
> > desktop or laptop is compromised somehow the (remote) backups are
> > still secure.
> ---
>    Excellent!  In my case, my laptop/desktop (used to be a laptop) is
> thoroughly entwined with the server such that one has trouble functioning
> without the other.
> 
>    In your case, though, I was thinking of a backup process that would
> only be used when my laptop was on a secure network (like @ home).
> 
Yes, but as above, if my laptop is compromised in any way (hopefully
unlikely but still possible) I want my backups to be safe still.

>    If there is risk to your laptop while @ home, hopefully it has a
> short-timeout that bounces it to the screen saver that requires a
> password to unlock?t
> > 
> > The backup system that runs the rsync daemon has its rsync configured
> > with 'refuse options = delete'
> ---
>    Ahh...I thought you were actually trying to keep them in sync.
> Maybe you might think about using an actual backup prog like tar.
> In my case, the Users/groups are the same.  Tar handles ext attrs and
> acls and can keep track of backing files up that have actually changed
> rather than relying on time/date stamps.
> 
My *backups* of important data are incremental backups done once a day
for every machine. I also do hourly incremental backups on my desktop
machine but that is more for protecting myself against myself than for
protecting against intruders or hardware failure.

The original point of this thread is about something closer to
synchronising my (small, Raspberry Pi) DNS server so that if it fails
I can get a DNS server back up and running as quickly as possible.


> >  so not only does someone with access to
> > my desktop/laptop need to know the rsyncd username and password but
> > they also cannot delete my existing backups.  It runs incremental
> > backups so nothing is ever overwritten either.
> ----
>    BTW, incremental backups aren't really the same as 'update' backups,
> they keep track of the state of the file system (including files no longer
> there)
> so you can restore your desktop to a specific day before some unwanted
> updated was introduced and kept by an update-only backup system.
> 
Yes, exactly, or more to the point (in my case anyway) I can restore a
specific file to a few hours ago after I've scrambled it in some
disastrous way! :-)

I use the rsync --link-dest option to make the incremental backups
(and, yes, I know this means that I only really have one copy of
unchanging files.  I do have more than one backup)

> Constructed it using rsync, but it really was too much work for
> too little feature.
> 
Mine too, as I said, is rsync with 'before the backup' and 'after the
backup' python scripts that do the housekeeping like thinning out
backups as they get older.

-- 
Chris Green



More information about the rsync mailing list