Restrict SSH access to only allow rsync
Rsync is still one of the most popular tools to synchronize files between two systems. Although it has a few caveats when dealing with special files, it can do its job very well. In this explainer we will show how to use it in combination with SSH and at the same restrict SSH access to only allow the rsync job to run.
In this article we refer to system01 having the original files and it wants to send them to the receiving system (system02)
Create user on receiving system
The system that receives the files (system02) should have a user that will be used for the file transport. Typically this is a dedicated user for file transfers. For this example we call it backupuser. The user does not need a password, as we don’t want interactive logins.
adduser --disabled-password --shell /bin/bash --gecos "Backup user" backupuser
Generate the key
Using the ssh-keygen utility we can create a new key. In this example we will store the SSH keys in /data/ssh-keys and restrict access, so let’s create that path first.
mkdir -p /data/ssh-keys
chmod 700 /data/ssh-keys
Next step is the creating of the key.
ssh-keygen -t ed25519 -f /data/ssh-keys/backupuser-key -C "backupuser for system1"
The -t defines the type of key, in this case Ed25519. For modern versions of SSH this will be the default, but older systems might still use RSA. By defining the type we ensure that we have the right type.
Add entry to authorized_keys
On the receiving system (system02) we need to create a file .ssh/authorized_keys. Create the related paths and set the permissions.
cd /home/backupuser
mkdir .ssh
chmod 700 .ssh
touch authorized_keys
chmod 600 authorized_keys
Insight: SSH is very restrictive when it comes to file permissions. If they are too loose, the usage of SSH keys won’t work.
Set permissions
mkdir /data/backups/system01
chown backupuser:backupuser /data/backups/system01
chmod 750 /data/backups/system01
Copy the restricted rsync access to the authorized_keys
Within the authorized_keys file we now need to tell what command can be executed when we use a particular key.
command=“rsync –server -vlogDtprCze.iLsfx –delete . /data/backups/system01”,no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-ed25519 AAAA…….. backupuser for system1
This line tells SSH that it should restrict access (e.g. no shell, no forwarding of anything related to the SSH agent or X11). It also defines what command is allowed, which is restricted to the rsync command.
Important is that we need to replace the last part, as that includes the public key and key comment. This part can be found on the sending system in /data/ssh-keys/backupuser-key.pub.
Initiate the synchronization
On system01 we will now run the action to start the copy.
rsync -e 'ssh -i rsync_key' --archive --cvs-exclude --checksum --compress --verbose --delete /path/to/files/to/backup backupuser@system02:/data/backups/system01
Tip: add the first time the –dry-run parameter so that you can see and test that everything should work as expected
If everything works as expected, the files should be synced now to the other system.
