6

I will be setting rsync between two webserver. I am aiming to have backup of data from my primary server on the secoundary in case if primary server crashes. My question relates to setting up on primary server a user account for rsync purposes.

For obvious reasons I don't want to use my "root" user account here. Therefore I am aiming at setting up another account which will be used only for rsync purposes. As I understand this user will need read permissions to all files that I will need to transfer (apache configuration, user linux files, www-data).

How to best set up such permissions? Should I grant rsync user root privileges or is there any more secure way to create user for such backup?

Kupiakos
  • 103
  • 4
Abdel5
  • 171
  • 1
  • 1
  • 6

1 Answers1

4

If the network connecting both servers is secure (e.g. a local network at your office) then you can use rsync in daemon mode to connect as root. This way you don't use ssh to make the connection.

On the secondary system, create a file /etc/rsyncd.conf with the following contents:

[all]
  path = /
  read only = no
  uid = 0
  gid = 0
  hosts allow = primary-host
  auth users = backupuser
  secrets files = /etc/rsyncd.secrets
  exclude = /tmp/ /var/tmp/ /var/cache/ /proc/ /sys/ /dev/ /run/ /boot/

Now create a file /etc/rsyncd.secrets with e.g.:

backupuser:thisisasecretpassword

Make the file only readable by root:

# chown root /etc/rsyncd.secrets; chmod 400 /etc/rsyncd.secrets

Now you need to ensure that rsync is started as a daemon; that depends on your distribution, with Debian you edit /etc/default/rsync and change the RSYNC_ENABLE line to RSYNC_ENABLE=true and run /etc/init.d/rsync start (if running systemd then run systemctl enable rsync; systemctl start rsync).

Now you can run rsync on the primary host and send whatever you need to replicate to the secondary by doing e.g.:

# rsync -ai /var/www/ backupuser@secondary-host::all/var/www/

Rsync will ask you for the secret password in this case.

wurtel
  • 3,864
  • 12
  • 15
  • Thanks for comprehensive answer. Unluckily my two servers are in remote localisation (only internet connection). As I understand from http://stackoverflow.com/questions/1821526/rsync-encryption to make transfer secure I may either create VPN encrypted network between those two server or use SSH. Which one would you recommend? – Abdel5 Sep 24 '15 at 10:44
  • 1
    I would recommend using daemon mode over ssh, with a forcecommand in the `authorized_keys` file to secure it. http://www.sakana.fr/blog/2008/05/07/securing-automated-rsync-over-ssh/ may be helpful. – wurtel Sep 24 '15 at 10:50