1

I have a control server (CS) that has SSH access to many others (H1, H2, etc). I would like CS to be able to initiate a rsync transfer between any two H* servers without those hosts knowing how to directly connect to each other.

I've looked at local/reverse port forwarding, but it seems that is only useful when H1 and H2 cannot directly talk to each other on the network. H1 still needs an authorized key on H2 for it to work, which is something I want to avoid.

Agent forwarding reads like it has the drawback of allowing an untrusted H1 to use any of my keys to the other hosts. I don't want H1 to gain access to anything else, only H2 for the duration of the transfer.

Is there a way I can establish SSH connections from CS to H1 and from CS to H2, and then have rsync (on either CS or H1) communicate via those channels to H2 without requiring additional authentication? Something like a command tunnel that is preauthorized?

  • What software do the hosts run – all OpenSSH? – grawity Nov 16 '18 at 8:13
  • Yes. OpenSSH on all servers, latest releases from CentOS and Ubuntu repos. – jimp Nov 16 '18 at 18:09
  • Do you need rsync, or would scp work? – Gordon Davisson Nov 17 '18 at 7:43
  • I’m actually using both. I would appreciate an answer for scp, so I don’t have to rewrite those commands, but I don’t think I can do without rsync because of its whole tree capabilities. – jimp Nov 17 '18 at 15:03

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.