Question: Security for Rsync backup server

Maintenance
1

I am performing a review of my MIAB security setup and noticed a hole with regards to rsync backups.

Currently, the backup user that logs in to the rsync backup server (using the native MIAB backup function) has full ssh shell access using passwordless login. The key for the passwordless login is /root/.ssh/id_rsa_miab only accessible by root.

If an attacker were to gain access to root on the MIAB server they could then gain access to the backup server. This creates a possible total-loss scenario where the MIAB server and backups could be destroyed; and also creates a vector for further attacks once the backup server is compromised.

Does anyone have any best practices to mitigate this potential problem or done this already? I was thinking of a couple of different approaches:

  1. limit ssh command execution to just the rsync commands that duplicity issues (using sshd command= function). This approach seems like it might be fragile since all the “allowed” commands need to be predefined.
  2. setup the backup server as a staging area and pull the backups off regularly to the “real” backup location (or take daily snapshots on shared storage array).
  3. ??

Any additional thoughts welcome.

-JB

2

I would be curious to know if there is there a way to not have this problem when your server is sending the data using ssh and rsync. If the concern is that great, then yes either implement a solution on the backup server or use a different method. Otherwise use a different backup solution.