Linux System Administration Recipes A Problem-Solution Approach

CHAPTER 4 ■ TAKING BACKUPS AND MANAGING DATA■ Note See recipe 6-1 for further discussion of ssh and keys.To create your private key, enter this into a terminal window on your home machine:ssh-keygen -t rsa -f ~/.ssh/rsyncThis will generate an RSA key and save it in ~/.ssh/rsync.■ Note You can also generate DSA keys. DSA is a slightly older standard than RSA. It’s quicker for someoperations (notably for key generation), but RSA is quicker overall. It’s sometimes suggested that RSA is strongerthan DSA, but there’s some debate about the details of this. The default key length for RSA is 2,048 bits, whereasDSA keys must be 1,024 bits long. Since longer keys are in general stronger, this is a significant advantage forRSA, which is also more flexible. Unless you have a specific reason for using DSA, stick with RSA.You will be prompted for a passphrase. Hit Enter to leave this blank. You will now have files rsyncand rsync.pub in your ~/.ssh directory.With a passworded key, all you would need to do here is add the contents of ~/.ssh/rsync.pub to thefile ~/.ssh/authorized_keys2 on offsite.example.com. However, with a passphraseless key, that’s a badidea, since then if an attacker gained access to your home machine, they would also immediately haveunlimited access to your account on offsite.example.com.Instead, it’s possible to reduce the security risk by restricting what this particular key can do. In thiscase, let’s restrict it to a single command, using the ~/.ssh/authorized_keys2 file onoffsite.example.comCopy ~/.ssh/rsync.pub to tmpfile, and edit tmpfile so that it’s a single line (this single line is thepublic half of your key, which will look like a big block of random characters, with an English identifier atthe end). Then add this at the start of that line:command="rsync -avuz -e "ssh -i /home/user/.ssh/rsync" /test user@offsite.example.com:/home/user/backup", no-port-forwarding,no-X11-forwarding,no-agent-forwarding ■ Note There are line breaks here for printing reasons only; your version should not include any line breaks. Itmust be a single line, including both the previous code and your private key.Now add the contents of tmpfile to ~/.ssh/authorized_keys2 on offsite.example.com (using cutand paste, or cat). Again, ensure that it remains as a single line.109Download at WoweBook.Com