I want to synchronize (both directions) a certain folder between a server (S) and a local machine (L). On both S and L, I have the same system (Ubuntu) and a user jan, with sudo privileges (i.e. in admin group). The SSH access to S is possible only with key authorization.
I figured I can use unison
for this. And I have created a new key pair with empty password. The problem is that I do not want to allow unlimited access to this password-less key.
(EDIT: I want to (e.g.) distinguish between different SSH authorized keys for the same user - and in one case restrict the access to only one directory and if possible only to run a specific command - as with rrsync below.)
I could use rsync
. It has a server-side script rrsync
and you can then restrict the access for the key in the authorized_keys
file:
command="$HOME/bin/rrsync -ro /home/jan/sync_folder/".
But rsync
cannot handle deleted files etc.
Another option is to set chroot jail on the server, but I still need to be able to access the server freely with my first key.
I could create a new user account, through which the synchronization would be done (and apply chroot jail + not included in admin group), but then I would lose the meta-information about the files (ownership, permissions). All files are owned by only one user (so ownership is not an issue), but some files are executable scripts, some not.
Any ideas how to synchronize the folders, while keeping the access secure? I have no preference in the tool. Those above are just what I have found after some studying.