https://dan.langille.org/2025/04/17/using-ssh-authorized-keys-to-decide-what-the-incoming-connection-can-do/ Skip to content Dan Langille's Other Diary He has another, more popular, diary. This one is more general. Dan Langille's Other Diary He has another, more popular, diary. This one is more general. Main Menu * PGCon - keynote... made your travel bookings yet? * Xorg.0.log for my RadeonHD Using ~/.ssh/authorized keys to decide what the incoming connection can do Leave a Comment / ssh / By Dan Langille / April 17, 2025 ~/.ssh/authorized_keys allows you to specify the command run by the incoming ssh connection. I was searching for a previous blog post to give you some background. I failed. I backup my Bacula database and my Bacula configuration via rsync. These backups go to more than one host. The following are lines from ~rsyncer/.ssh/authorized-keys on my dbclone host - which gathers database backups from various hosts. from="x8dtu.example.org,10.1.1.1",command="/usr/local/sbin/rrsync -ro /usr/home/rsyncer/backups/bacula-database/postgresql/" ssh-ed25519 AAAAC3thisisalsonotmyrealpublickeybcxpFeUMAC2LOitdpRb9l0RoW7vt5hnzwt rsyncer@x8dtu.example.org The above appears on two lines to make it easier to read without horizontal scrolling - in the file, it's all on one line. This says: * when an ssh connection comes in from a client at x8dtu.example.org, or 10.1.1.1 * run /usr/local/sbin/rrsync -ro /usr/home/rsyncer/backups/ bacula-database/postgresql/ * and that client must have this key (as shown) * rsyncer@x8dtu.example.org is a comment, and has no effect What does /usr/local/sbin/rrsync -ro /usr/home/rsyncer/backups/ bacula-database/postgresql/ do? See man rrsync, a program supplied with rsync. In short it is "script to setup restricted rsync users via ssh logins". It means the incoming client can only rsync from the specified path / usr/home/rsyncer/backups/bacula-database/postgresql/ and that the session is ro (read-only). This is a great feature. Given that these passphraseless ssh-keys allow access to a rather important system (it has all the database backups), imposing such restrictions seems a good idea. This works well for transferring the Bacula database back from dbclone over to x8dtu. Now, what if I want to copy a different database backup in the other direction, from x8dtu to dbclone? I have previously decided that dbclone is a pull-only host. That is nobody can push data to it. My solution: the command specified in ~ /.ssh/authorized keys initiates an rsync on dbclone, pulling data from x8dtu. That script looks something like this. [rsyncer@dbclone ~]$ cat /home/rsyncer/bin/rsync-backup-from-x8dtu.sh #!/bin/sh # # This file does a backup of each database on the server. # It relies upon a file on the server to do the actual backup, # then uses rsync to copy the files from the server to here. # # the ~/.ssh/authorized keys entry on the server must look like this: # # from="10.55.0.140",command="/usr/local/sbin/rrsync /usr/home/backups/" [ssh key goes here] # # invoking rrsync ensures the incoming rsync process is chrooted to /usr/home/dan/backups/ # Thus, BACKUPDIR is relative to that location. BACKUPDIR=${HOME}/backups/x8dtu-pg01/database-backup IDENTITY_FILE_RSYNC=${HOME}/.ssh/id_ed25519 SERVER_TO_RSYNC=x8dtu.example.org cd ${BACKUPDIR} # # use rsync to get local copies # /usr/local/bin/rsync -e "/usr/bin/ssh -i ${IDENTITY_FILE_RSYNC}" --recursive -av --stats --progress --exclude 'archive' ${SERVER_TO_RSYNC}:/ ${BACKUPDIR} Great. Now all I need to do is add another entry into authorized_keys on dbclone, resulting in something like this: from="x8dtu.example.org,10.1.1.1",command="/usr/local/sbin/rrsync -ro /usr/home/rsyncer/backups/bacula-database/postgresql/" ssh-ed25519 AAAAC3thisisalsonotmyrealpublickeybcxpFeUMAC2LOitdpRb9l0RoW7vt5hnzwt rsyncer@x8dtu.example.org from="x8dtu.startpoint.vpn.unixathome.org,10.8.1.100",command="/home/rsyncer/bin/rsync-backup-from-x8dtu.sh" ssh-ed25519 AAAAC3thisisalsonotmyrealpublickeybcxpFeUMAC2LOitdpRb9l0RoW7vt5hnzwt rsyncer@x8dtu.example.org Here's the problem. Both lines can't run. Only one will run. The incoming ssh key will match, and that command will be run. Instead. I added a second ssh key: [rsyncer@x8dtu ~/.ssh]$ ssh-keygen -t ed25519 -f id_ed25519.rsync.bacula ... I modified the above script to use that key: IDENTITY_FILE_RSYNC=${HOME}/.ssh/id_ed25519.rsync.bacula Next, I modified authorized_keys on dbclone to refer to the new public key (again, I've added newlines in here so you don't have to scroll): from="x8dtu.example.org,10.1.1.1",command="/usr/local/sbin/rrsync -ro /usr/home/rsyncer/backups/bacula-database/postgresql/" ssh-ed25519 AAAAC3thisisalsonotmyrealpublickeybcxpFeUMAC2LOitdpRb9l0RoW7vt5hnzwt rsyncer@x8dtu.example.org from="x8dtu.startpoint.vpn.unixathome.org,10.8.1.100",command="/home/rsyncer/bin/rsync-backup-from-x8dtu.sh" ssh-ed25519 AAAAC3thisisthesecondsshkeypKBYib6rCHZ+zK5Q3LvJFukdFzT+Q92GUtej6SLW8 rsyncer@x8dtu.example.org This works. It means that for each task to be carried out, I need a different ssh key. However, so far, there are just two tasks. Hope this helps. Website Pin Facebook [pin_it_but] Twitter Myspace Friendfeed Technorati del.icio.us Digg Google StumbleUpon Premium Responsive About The Author [dlangille] Dan Langille I've been playing with computers since I read an Elementary Electronics magazine way back in the 1970s. I started contributing to open source projects in 1998. After that, I gradually moved from being a software developer to being a systems administrator. - Previous Post Related Posts May 9 2013 The Bacula Tutorial jail server Leave a Comment / Backups, Bacula, BSDCan, Conventions, DHCP, Disks, File Systems, FreeBSD, Jails, NAT, Operating Systems, pf, PostgreSQL, ssh, ZFS / By Dan Langille Jun 11 2013 sshd: error: key_read: uudecode failed 1 Comment / Open Source, ssh / By Dan Langille Leave a Comment Cancel Reply You must be logged in to post a comment. Search [ ]Search Like what I do? As an Amazon Associate I earn from qualifying purchases. Want a good read? Please try: FreeBSD Mastery: Jails (IT Mastery Book 15) I really like this monitor light (see it on Twitter). Buy it on amazon. I found out the new gateway draws 22W. Here's the link for that hardware. Add new tag Bacula FreeBSD gmirror PostgreSQL Tape Libraries The ZFS server wordpress ZFS My Websites * BSDCan * DVL Software Limited * FreshPorts * FreshSource * langille.org * PGCon * The FreeBSD Diary * The Racing System * unixathome.org Copyright (c) 2025 Dan Langille's Other Diary Scroll to Top