>> I'm setting up an automated rdiff-backup system and I'm stuck between >> pushing the backups to the backup server, and pulling the backups to >> the backup server. If I push, I have to allow read/write access of my >> backups via SSH keys. If I pull, I have to enable root logins on each >> system to be backed-up, allow root read access of each system via SSH >> keys, and I have to deal with openvpn or ssh -R so my laptop can back >> up from behind foreign routers. The conventional wisdom online seems >> to indicate pulling is better, but pushing seems like it might be >> better to me. Do you push or pull? > > I would push, to be honest.
Me too. The rdiff-backup "UnattendedRdiff" wiki page only has instructions for pulling but that doesn't seem like the way to go: http://wiki.rdiff-backup.org/wiki/index.php/UnattendedRdiff > You can seperate the backups by giving each system a different account where > to store the backups. I'm not sure what you mean. The backups are all stored on the backup server. > This way you can also have better control over when to do the backup. If your > laptop hooks up via VPN just to quickly check email over an expensive or slow > link, you might not want the backup to start downloading all the pictures you > took during the holiday or that 300-page manuscript you wrote for your book. > > -- > Joost Here's what I'm doing. root on 3 machines pushes to non-root on a 4th machine via rdiff-backup and SSH keys. The SSH keys are restricted like so (although there is no from= for the laptop's key since it could be behind any IP): command="rdiff-backup --server",from="12.34.56.78",no-port-forwarding,no-X11-forwarding,no-pty ssh-rsa ... root@machine1 Is this a good arrangement? I think the worst-case scenario (compromised SSH keys) is read/write access of the non-root user on the backup server via rdiff-backup. Additionally, the backups on the 4th machine are pushed to another machine by root to non-root via rsync and SSH keys. Is there a way to restrict SSH keys to the rsync command? Should the non-root backup user have any special configuration? Can I reserve 0% for root on my USB hard drive which is only used for backups and does not contain an OS? - Grant
