On 08/19/11 14:00, Grant wrote: >> We're doing the same thing for our backups. Here's that chunk of our >> documentation, if it's helpful. > > Thanks Michael. You've found that a shell account is required on the > backup server in order to push backups to it?
Yes, you have to be able to run a command (rdiff-backup --server...) and that requires a shell. I tried to do it without a shell, but couldn't figure out how to do it sensibly. I do `chmod 700` all home directories. > Is the purpose of the Host block in .ssh/config to store the hostname > of the backup server so it doesn't need to be used directly in the > rdiff-backup command? It forces key-based authentication when connecting to the backup server. The default is password-based, which obviously won't work in a cron job. > Why create a password for the backup user? Doesn't that open up the > possibility of someone logging in as that user, when otherwise the > account would only be used for backing up files? It might work without one; in these instructions the machine-to-be-backed-up never connects to the backup server as root, and so you need a way to SCP stuff to the backup server. I usually use a `pwgen 16` password for these accounts and then immediately forget it, so nobody will log in to them for a few billion years at least. Does key-based authentication work with no password? I've never tried. I am emotionally troubled by the existence of local shell accounts, but rationally, I know that no one can ever log in to them.
