Re: [Nolug] Looking for an automated FTP backup script formysqldump

On Mon, 21 Jul 2003, Alex McKenzie wrote:

> I was under the impression that this was for an automated backup
> situation, which is what (I believe) passphraseless keypairs are meant
> for. I was also assuming a limited backup account, but it can work both
> ways.
>
> Auditing logs is one of the most useful, and easiest, security tasks you
> can do. It's a good habit to get into, and it can be automated with some
> scripts.

I have a central rsync server in our DR center and use rsync/ssh to backup
important files/servers hourly. All rsyncs are scheduled with cron from
the central server. Since some backups run as root (ie backing up /home),
i have a passphrase-less keys in the root accounts of some servers.
However the key is protected with a command=, PermitRootLogin is
forced-commands-only in sshd_config, and the only command allowed to run
is an rsync-wrapper.sh script that i found and modified. The wrapper
script is very very picky about what it will run. The rsync options have
to be exactly right or it'll just exit. So i am trusting ssh and that
script to do the right thing... so if the central server was hacked,
hopefully all he could do was run backups off all the servers.

I'm going to experiment with letting an unpriv backup user use sudo rsync
for the backups. that would add another layer of security, and be much
safer...

i don't know of a way to use the ssh-agent for non-interactive commands...
if anyone knows, let us know!

ray

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Ray DeJean  				       	 http://www.r-a-y.org
Systems Engineer                    Southeastern Louisiana University
IBM Certified Specialist  	      AIX Administration, AIX Support
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
___________________
Nolug mailing list
nolug@nolug.org