Rsync + public key authentication security

Question

I have read several articles how to automatically backup files with Rsync and public key authentication. All of them are very similar. I just finished setting up everything and everything works fine but... I just found an article which says it's not secure. I did the following:

1. On backup server I generated public and private keys.
2. I copied public key to the remote (original) servers directory: /var/sites/.ssh (file authorized_keys). The directory is owned by "user12"
3. I added the following to the authorized_keys file: from="BACKUP.SERVERS.IP.ADDRESS",command="/root/validate_rsync"

4. I created a file /root/validate_rsync with the following content:

   #!/bin/sh
   echo $SSH_ORIGINAL_COMMAND >> /var/log/synchronize-log.log
   case "$SSH_ORIGINAL_COMMAND" in
   *\&*)
   echo "Rejected"
   ;;
   *\;*)
   echo "Rejected"
   ;;
   *\(*)
   echo "Rejected"
   ;;
   *\{*)
   echo "Rejected"
   ;;
   *\<*)
   echo "Rejected"
   ;;
   *\>*)
   echo "Rejected"
   ;;
   *\`*)
   echo "Rejected"
   ;;
   *\|*)
   echo "Rejected"
   ;;
   rsync\ --server*) 
   $SSH_ORIGINAL_COMMAND
   ;;
   *)
   echo "Rejected"
   ;;
   esac
   

I run the rsync command:

rsync -avzp --del -e "ssh -p 2211" user12@ORIGINAL.SERVERS.IP:/var/sites/photos/ /var/sites/sync/photos

I got error message: permission problems with file /root/validate_rsync. I moved the file /root/validate_rsync to /var/sites/validate_rsync and chowned it to user12:user12

Now synchronization works. But I found an article which says it's insecure:

1- the validate_rsync command itself should not be owned nor writeable by the userid that executes the rsync command. Otherwise, rsync can be used to overwrite the validation script with another script that doesn't validate, or even execute arbitrary commands.

2- similarly, the authorized-keys file should not be owned or writeable by the rsync user, otherwise rsync can be used to overwrite that file, with one that removes the requirement to run validate-rsync, or with one that runs some other command instead.

Source

What can I do? If validate_rsync is owned by root, the synchronization does not start because user12 can't access root's files. If authorized-keys file will be owned by another user I will not be able to login with username user12.

My questions:

1. Where should I put validate_rsync and authorized-keys files, in which directory? What permissions and ownerships should they have?

2. Is there some way how to tell to the validate_rsync file to allow to synchronize only 2 folders: /var/sites/photos/, /var/sites/photos2/

Answer 1

Those security concerns are right. So, to answer your first question: to make it work as you like, you should put validate_rsync in a directory where user12 has execute permission, but not write. The very same validate_rsync file should have read and execute permissions for the user, but of course not write. The issue here is that /root by default is accessible only by root user, you need a path where each directory has execute permission for user12. For example, you could copy validate_rsync to /usr/local/bin and make it owned by root. As long as user12 can execute and read, it's OK.

You don't need to protect your authorized_keys file. It would be better to force user12 to run a command by configuration, putting in sshd_config the following:

Match user user12
  ForceCommand /usr/local/bin/validate_rsync

I think this solution is better than tinkering with authorized_keys.

Also, in your validate_rsync I would quote $SSH_ORIGINAL_COMMAND (safer), and I would change your case sentence to check the validty of the command for a regular expression using grep; easier, more compact and more powerful:

echo "$SSH_ORIGINAL_COMMAND" >> /var/log/synchronize-log.log
if echo "$SSH_ORIGINAL_COMMAND" | grep -qE '[&;<>`|]'; then
  echo Rejected
elif [[ "${SSH_ORIGINAL_COMMAND:0:14}" == "rsync --server" ]]; then
  $SSH_ORIGINAL_COMMAND
else
  echo Rejected
fi

To answer your second question, as you are logging the SSH_ORIGINAL_COMMAND, you can run a test with the directories you want to consider and then examine the SSH_ORIGINAL_COMMAND you are getting. Then you could make validate_rsync to validate just that command.

Answer 2

To protect the authorized_keys file, I came across this solution: https://superuser.com/questions/852434/how-to-protect-authorized-keys-file

It's pretty common to simply remove write-access to that file if you're not planning to change it often.

chmod 400 ~/.ssh/authorized_keys

Now, of course, that write access could be added back in by a malicious script, so you need to set the file and its parent directory to be immutable:

sudo chattr +i ~/.ssh/authorized_keys
sudo chattr +i ~/.ssh