I have 6 devices that i rsync to a central location to back them up. Ive been using ssh as the -e option. Problem is i use public key with passphrases, meaning to backup all six i need to go to each device and run the backup script. Since i typically backup /etc, /home, and /root this means entering sudo and the ssh passphrase 3x for each device.

I would much prefer a script that runs on back storage device that can pull the data from each device without having to use ssh (encryption is not necessary since all traffic is either local or going through a vpn connection).

I could then put this script in root’s crontab or make it a systemd service running as root.

But i dont know how i can remote sync without ssh

  • Ramin Honary@lemmy.mlEnglish
    6·
    2 years ago

    I am also going to recommend the same solution as @matcha_addict@lemy.lol in this comment: https://lemmy.ml/comment/7998407

    You can create a key pair that is specifically just for this kind of backup transaction.

    To limit its affects, create a user and group on each of the devices that are highly restricted.

    This is actually the most secure solution that doesn’t require an interactive password prompt. The passwordless key only serves this one purpose and has small attack surface.

    Basically, you can tell SSH to allow root login on certain devices by setting up a root key pair. You configure SSH on the target device such that when it logs in, the login must run a script or a single command instead of running a shell, this limits what attackers can do if they somehow steal your private keys. You can also keep these private keys in your SSH agent so you only have to enter their passwords once, this will allow you to run remote commands without a password.

    I would recommend also exploring the possibility of setting up an Rsync Daemon on each remote device, it keeps an Rsync process running on a remote device and listens for connections from Rsync clients. https://linuxconfig.org/how-to-setup-the-rsync-daemon-on-linux

    On an unrelated topic: you might also want to look into using Btrfs and making and transferring snapshots to other devices.

    • The Doctor@beehaw.orgEnglish
      3·
      2 years ago

      There’s a somewhat more secure way to go about it.

      A backup script on the host in question runs periodically as root and makes a local copy of the files owned by the backup user. The central host then makes a backup of the not-root-owned files on the host in question. It adds two extra steps but you don’t have to set up SSH access for the root account.

    • neosheo@discuss.tchncs.deOP
      2·
      2 years ago

      I have decided to use rrsync to do this.

      Im using btrfs on the back drive but using ext4 on the remote devices. Wont the snapshots, if sent to a remote device be the same size as the original data?

      • Ramin Honary@lemmy.mlEnglish
        1·
        2 years ago

        I guess the Btrfs snapshopt approach is not possible for your setup since the devices you want to backup are not Btrfs and cannot create snapshots.

        Yes, the snapshots will be the size of the whole partition, I had not thought about that problem. I do not know if it is possible to create incremental snapshots with Btrfs.

  • Nibodhika@lemmy.world
    2·
    2 years ago

    You can create a second SSH key without passphrase, add that to the authorised keys, and specify to use that key instead, for example using an SSH config file.

    Now this is a bit of a security flaw because anyone with access to the key can use it, so you can use rrsync to make sure that key only has access to rsync, so worst case scenario it can destroy your backup, but that’s expected since you want write access to your backup without inputting a password.

    • neosheo@discuss.tchncs.deOP
      2·
      2 years ago

      I’ve tried it before but i want a situation where i dont need to use the ssh agent. I think i’m gonna go with using rrsync

    • Nibodhika@lemmy.world
      2·
      2 years ago

      I love this answer because it’s exactly what he’s asking, but absolutely what he shouldn’t do hahahaha.

      Anyone wondering, go to a computer and type nc -lp PORT > file (Replacing PORT with the port you want to use), now go to a different computer and type nc IP PORT < FILE (Replacing IP and Port with the IP from the first machine and the PORT you ran on the command there, and FILE with a file you want to copy). Congratulations, you just copied a file from one machine to another without using SSH.

      • SolidGrue@lemmy.worldEnglish
        2·
        2 years ago

        You can pipe tar through it too.

        Receiver: nc -lp 12345 | tar xf -
        Sender: tar cf - . | nc 192.168.0.123 12345

        Also dd if you’re moricated to image over the network.

        I mean, he asked…

  • knfrmity@lemmygrad.ml
    1·
    2 years ago

    You could rsync with directories shared on the local network, like a samba share or similar. It’s a bit slower than ssh but for regular incremental backups you probably won’t notice any difference, especially when it’s supposed to run in the background on a schedule.

    Alternatively use a non-password protected ssh key, as already suggested.

    You can also write rsync commands or at least a shell script that copies all of your desired directories with one command rather than one per file.