Re: [rdiff-backup-users] Post-setup questions

[Maarten Bezemer]

On Fri, 19 Aug 2011, Nicolas Jungers wrote:

> There is a third solution, designed specifically for that kind of
> problem.  You can put a command= option in front of your key in the 
> authorized_keys file to restrict the usage of the key to a specific [set of] 
> command. See AUTHORIZED_KEYS FILE FORMAT in "man sshd".

OP mentioned having problems with the command= option...
But if you can get that to work properly (and restrict it to read-only 
access), that would even be preferable to push-style, since compromising 
the backup server would then at most give the attacker read access to the 
'laptop', for which the data was already on the backup server.. so no real 
gain for an attacker.

Push-style "would only have the risk of accessing the laptop's backup on 
the backup server", but for me, the risk of losing a backup when my laptop 
is hacked/stolen/lost is simply unacceptable. If one doesn't mind losing 
her backups when the primary device is compromised, then she shouldn't 
bother backing it up in the first place.


--
Maarten