3

This seems very tricky to me.

I've set up my two systems so that I can rsync files between them as me, without specifying password. Now the the problem is to rsync files that belong to root. On both of my systems, there are no root passwords. The only way to become root is via sudo. So I can neither give a password for sudo rsyn local root@remote:, no use my ssh-agent to supply pass phrase. I don't want to set up a root password on any systems; and I do need the files to be owned by root on both systems.

EDIT: Using the files that belong to root is just an example, I need a way for my unprivileged account to read/write system (including root-owned) files easily. One example is to copy my configured /root environment into the freshly-installed system. The two systems are actually two VMs under a single host, so it's not a big concern for me to copy root-owned files between them.

EDIT 2: If I only want to copy my configured /root environment into the freshly-installed system, I can use tar:

sudo tar cvzf - /root | ssh me@remote sudo tar xvzf - -C /

But I do need rsync to update from time to time. Any easy way to make it happen?

EDIT 3: Formally formulate the question

Alright, it all began with the question, how to rsync files that belong to root between two systems as a normal unprivileged user, without specifying password, under the condition that,

  1. The root account is locked on both of systems. I.e., there are no root passwords. The only way to become root is via sudo (recommended security practice, see http://help.ubuntu.com/community/RootSudo)
  2. I don't want a completely passwordless sudo but don’t want to be typing passwords all the time either.
  3. The normal unprivileged user has entered their ssh pass phrase into the ssh agent.

Thanks

3
  • Your tar command won't work, you will need to enter the remote sudo password and sudo will complain if you don't use the -t flag with ssh. In this case, I can't get your pipe to work even with -t.
    – terdon
    Jun 9, 2013 at 3:00
  • No, it works fine. I tested before I post it. Oh, I don't need to enter any password for sudo. (This is Ubuntu)
    – xpt
    Jun 9, 2013 at 3:01
  • I'm not sure if this will work, but back in the 'olden days' you would've used hosts.equiv(5) and do the rsync via rsh(1), although supposedly you can use a similar approach in conjunction with ssh instead of rsh.
    – Aya
    Jun 9, 2013 at 16:26

4 Answers 4

4

You can do it directly with rsync with creative using of --rsync-path option. So you would use:

rsync -a -e "ssh" --rsync-path="sudo rsync" localdir/ [email protected]:/remotedir

Note that this require that "sudo rsync" on remote host will NOT ask for passphrase. That can be accomplished in several ways:

  • doing sudo -v on remote before running rsync (ideal for one-off rsync jobs). Your sudo must not use tty_tickets option for this to work.
  • putting username ALL= NOPASSWD:/usr/bin/rsync in /etc/sudoers on remote host.
  • using pam-ssh-agent-auth on remote for /etc/pam.d/sudo

Of course, you could also instead of "rsync over ssh" use "rsync in daemon mode" (see rsyncd.conf(5) and /etc/default/rsync on Debian GNU/Linux for example) to accomplish what you want, with additional benefit of better speed of transfer.

2
  • Is the flag -e ssh not superfluous? SSH should be the default transport.
    – Steven Lu
    May 6, 2022 at 9:08
  • @StevenLu today it is (unless you happen to have veeery old legacy system). But back in the days, it was still likely to have a system with different default. Hint: even today (for historic reasons only!), environment variable equivalent to -e option is called RSYNC_RSH May 6, 2022 at 22:37
3

The solution.

  1. Adding the user's ssh key to remote root works, but only half way, i.e., now rsyn ... root@remote:... works. The challenging part is to get sudo rsyn ... work as well.
  2. To get sudo rsyn ... work, what's need is -- Using SSH agent for sudo authentication, http://www.evans.io/posts/ssh-agent-for-sudo-authentication/
  3. To install pam-ssh-agent-auth PAM module under Ubuntu, you can use the ppa that I've just built, https://launchpad.net/~suntong001/+archive/ppa. Tested fine under Ubuntu 12.04 precise, and 13.10 saucy.

HTH

2
  • +1, well done and thanks for finding it. I still think you are jumping through unnecessary hoops and would be better off activating your root account, but this does indeed work.
    – terdon
    Jun 26, 2013 at 13:25
  • @xpt Usually, "thanks" for a useful answer = +1 to that answer :-) Oct 8, 2013 at 1:00
0

Another way would be to create a .sh script on both servers, containing your rsync scripts.

Then run them via cronjob or via ssh:

ssh not-your-root-user@remoteserver sudo sh your-rsync-script.sh

Or just run your rsync script directly through ssh

ssh not-your-root-user@remoteserver sudo rsync local root@remote

I would prefer cronjob if its a scheduled rsync job.

4
  • How would he give the password to the remote sudo command? Also, he can't log in as root@remote, that's the whole problem.
    – terdon
    Jun 9, 2013 at 1:30
  • and, moreover using unprivileged account can't read/write root files, which is why I asked.
    – xpt
    Jun 9, 2013 at 1:33
  • Sorry I was a bit tired yesterday when wrote that stuff. Off cause enabling root account would be the best thing to do here. :) Good luck
    – Bolli
    Jun 9, 2013 at 9:05
  • Thanks @Bolli. Enabling root account would be my last resort. I'll try to avoid it as much as I can. I'll do more testing and get back to you. My plan is, 1. hard link ssh config files from my normal unprivileged user to /root/.ssh. Or 2. add my ssh key to root. I do believe there will be an simple and easier way...
    – xpt
    Jun 9, 2013 at 14:27
0

Well it depends on what you want to do. Do the files need to be owned by root on both systems? They won't if you are simply doing a backup so you can just run rsync as root but logging in to the remote server as your normal user.

Create a key for local root to log in as remote normal user (I will use xpt as your normal user's name):

sudo -i
ssh-keygen -t rsa
ssh-copy-id -i ~/.ssh/id_rsa.pub xpt@remote

You should now be able to do a password-less ssh or rsync (as root) like so:

rsync /path/to/local xpt@remote

If the files need to be owned by root on both systems, things get a little bit more complex. The easiest thing to do would be to just set up a root password on both systems:

sudo -i
passwd 

Now you can log on as root to your hearts content.

Of course, the best thing to do would be to not copy files over the network as root. I can't really imagine why you would want to and the risk is not really worth the effort, just copy the files over and play with sudo as needed once they have been copied.


UPDATE:

I repeat that the simplest way to do this is to create a root password for each machine and then copy across as root. I don't understand why you don't want this, it is as simple as running sudo passwd.

Anyway, if you insist that you don't want to create a root password, the only way around this I can see is to run two commands:

  1. Run rsync to copy to a user writable directory (I use mktmp to create a random directory name):

    dir=`mktemp -u`; && sudo rsync -avz /root xpt@remote:$dir
    
  2. Move the contents to remote:/root

    ssh -t lacoloc@badabing sudo rsync -avz "$dir"/* /root
    

    The -t option forces tty allocation and is necessary to run sudo commands on the remote system.

You can combine the two by adding this to your ~/.bashrc file (let me know if you don't use bash):

function Rrsync(){
    dir=`mktemp -u` &&
    sudo rsync -avz $1 $2:$dir &&
    ssh -t $2 sudo rsync -avz $dir/ $3 && rm -rf $dir
}

You can then call the function like this:

Rrsync /root xpt@remote /root
------ ----- ---------- -----
   |     |       |        |---> The target directory on the remote server
   |     |       |------------> username@server 
   |     |--------------------> Path to local source directory
   |--------------------------> The function name

Bear in mind that you may have to play around with adding/removing a trailing slash / from the rsync source and targets depending on whether you're copying a directory or the directory's contents. See man rsync.

In order to get this to work without a password, you will have to run ssh-keygen and ssh-copy-id as root as I described at the very beginning. You will still have to enter your password for the two sudo commands, once for your local machine and once for the remote.

10
  • thank @terdon. No, I don't want to set up a root password on any systems; and I do need the files to be owned by root on both systems.
    – xpt
    Jun 9, 2013 at 1:25
  • @xpt please update your question with your exact requirements. Why do you need the files to be owned by root? What kinds of things are you copying? If I knew exactly what you're trying to do I might figure out a workaround.
    – terdon
    Jun 9, 2013 at 1:28
  • @xpt I updated my answer with another solution. Seriously though, why don't you just make your life easier and create a root password? It is just a single command and much simpler than what I have suggested.
    – terdon
    Jun 9, 2013 at 2:56
  • It's the recommended security practice, help.ubuntu.com/community/RootSudo. By default, the Root account password is locked in Ubuntu. This means that you cannot login as Root directly or use the su command to become the Root user. However, since the Root account physically exists it is still possible to run programs with root-level privileges, with sudo.
    – xpt
    Jun 9, 2013 at 3:07
  • One of the reason being: "Every cracker trying to brute-force their way into your box will know it has an account named Root and will try that first. What they don't know is what the usernames of your other users are. Since the Root account password is locked, this attack becomes essentially meaningless, since there is no password to crack or guess in the first place."
    – xpt
    Jun 9, 2013 at 3:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .