Re: [gentoo-user] {OT} rdiff-backup: push or pull?

[Grant <emailgrant@gmail.com>]

>> >> > You can seperate the backups by giving each system a different
>> >> > account
>> >> > where to store the backups.
>> >>
>> >> I'm not sure what you mean.  The backups are all stored on the backup
>> >> server.
>> >
>> > Each machine to be backed up has a different account on the backup
>> > server. This will prevent machine A from accessing the backups of
>> > machine B.
>> >
>> > This way, if one machine is compromised, only this machines backups can
>> > be accessed using the access-keys for the backup. And this machines
>> > keys can then be revoked without affecting other backups.
>>
>> That's a great idea.  I will do that.  Should that backup account have
>> any special configuration, or just a standard new user?
>
> I would suspect just a standard new user with default permissions.
> Eg. only write-access to his/her own files.
>
> And I'd prevent that user account from being able to get a shell-account.

I created the backup users and everything works as long as the backup
users have shells on the backup server and are listed in AllowUsers in
/etc/ssh/sshd_config on the backup server.  Did I do something wrong
or should the backup users need shells and to be listed in AllowUsers?

Should I set up any extra restrictions for them in sshd_config?
Should I set passwords for them?

- Grant


> A ".bashrc" with "exit" as the last or first entry is a nice touch. Especially
> if you set the permissions such that it works for the user but the user can
> never change that file.
>
> --
> Joost