After a bad accident with rsync deleting wrong files due to wrong destination parameter, I want to restrict rsync (or the bash script running it) to be able to delete/modify files only under a certain directory. I thought of either:

  1. create and run rsync/script under a user which has permissions only to that directory. The problem here is: How do I use/create a such user dynamically? (This is part of a build script that should "just run" for other users).

  2. verify that destination paths given to rsync are under a certain directory. The direction seems to be using the test command, but I couldn't figure out how to use it correctly, and it's not as safe, since the test of the path parameter can still go out of sync with the actual path parameter being run, so I think (1) is more robust.

  • You can't create users without root access, so that can't be done dynamically unless you run as root. Route 2 is very simple, just do a pattern match on the path you have been given and exit if it does not match what you want.
    – terdon
    Sep 18 '13 at 23:11
  • @terdon yes, I know (2) is simpler, but can also break a lot more easily. I guess I'm looking for something like a 'restricted shell' for rsync to run in, or some concept of 'limit script to directory' which isn't directly available with bash/linux model. Thanks.
    – snowdragon
    Sep 21 '13 at 12:13
  • Use the -in switches before running with any of the -delete options. Sep 30 '13 at 14:38

When using pubkey auth, you could enforce such behaviour with help of the authorized_keys file and rrsync, which is part of rsync. It usually lies gzipped in the rsync docs dir, e.g. on a Debian box in: /usr/share/doc/rsync/scripts/rrsync.gz

On the target machine, you need to:

  • Extract the script to some location, e.g. "/usr/bin" or "~/bin"
  • Set up an authorized key in "~/.ssh/authorized_keys"
  • Prepend the key with the command option set:

    command="/usr/bin/rrsync /foo/bar/baz" ssh-rsa AAAA[...]

When rsyncing with a rootdir set, don't forget to modify the target path to be relative to the given rootdir.


If you can start rsync daemon on destination, you can predefine which directories (called modules) you allow access. Just edit /etc/rsyncd.conf and add something like:

        path = /tmp

Now you can transfer using the rsync protocol using the alias(module) name instead of the raw directory path:

rsync --delete /origin/dir rsync://$DEST_HOST/mydirectory

/mydirectory will be translated to /tmp, and if you misspell mydirectory you will get an error instead of messing up the files.

This was probably the simplest example, but you can also configure authentication, and a lot of other parameters. You can find more info here:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.