This is the scenario. We have a multitude of servers, currently we simply ssh in as root using our keyfile and then when we need to rsync we use the root user.

All very easy.

What we would like to do is prevent root from shelling in to any of our servers but still be able to easily transfer files and folders between different servers. We do this all day every day and adding extra steps is time costly, something we cannot afford.

We are testing the setup of a limited privilege administration account on each box that has sudo rights to run commands. A user then logs in to the box using ssh -A adminusername@host. This makes it easy to move from box to box in an unfettered way.

This is where I am having an issue with rsync/scp. How do I copy a folder to or from the current box to a remote box when the admin account only has limited privileges and root is prevented from logging in via shells.

The only thing I can think of is sharing root keys among the boxes and allowing root to login using keys only. In this scenario there would be one root key for all boxes (it would be a nightmare to maintain different keys on every box).

Am I on the right track or is there a better way I haven't been able to find?

  • Did you think to use tar on the fly? Get it a look here for example... (I mean with tar you can preserve username permissions... it the remote AdminUser has the right via sudo to use as root tar...) – Hastur Mar 24 '16 at 7:30

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.