rsync remote files over SSH to my local machine, using sudo privileges on local side, and my personal SSH key

Question

I want to sync a directory /var/sites/example.net/ from a remote machine to a directory at the same path on my local machine.

The remote machine only authenticates SSH connections with keys, not passwords.

On my local machine I have an alias set up in ~/.ssh/config so that I can easily run ssh myserver to get in.

I'm trying rsync -a myserver:/var/sites/example.net/ /var/sites/example.net/ but it fails because my local user does not have permission to edit the local directory /var/sites/example.net/.

If I try sudo rsync -a myserver:/var/sites/example.net/ /var/sites/example.net/ (just adding sudo), I can fix the local permission issue, but then I encounter a different issue -- my local root user does not see the proper ssh key or ssh alias.

Is there a way I can accomplish this file sync by modifying this rsync command? I'd like to avoid changing anything else (e.g. no changes to file perms or ssh setup)

Answer 1

Try this:

sudo rsync -e "sudo -u localuser ssh" -a myserver:/var/sites/example.net/ /var/sites/example.net/

This runs rsync as root, but the -e flag causes rsync to run ssh as your local user (using sudo -u localuser), so the ssh command has access to the necessary credentials. Rsync itself is still running as root, so it has the necessary filesystem permissions.

Answer 2

Just improving on top of larsks's response:

sudo rsync -e "sudo -u $USER ssh" ...

So in your case change rsync -a myserver:/var/sites/example.net/ /var/sites/example.net/ to sudo rsync -e "sudo -u $USER ssh" -a myserver:/var/sites/example.net/ /var/sites/example.net/.

Answer 3

With regards to @larsks' answer, If you have your key loaded into the ssh agent, which is my use case, you can instead do:

sudo rsync -e "env SSH_AUTH_SOCK=$SSH_AUTH_SOCK ssh" /source/path /destination/path

Instead of the double sudo.

My use case, if anyone is interested in replicating, is that I'm SSHing to a non-root sudo-er account on remote A, and need to rsync root-owned files between remote A and remote B. Authentication to both remotes is done using keys I have on my real local machine and I use -A to forward the ssh-agent authentication socket to remote A.

Answer 4

Guss's answer works well if you want to use sudo rsync for local file permissions but want to utilise your user's SSH session. However, it falls short when you also want to use your SSH config file.

You can follow Wernight's approach by using sudo to switch the user for the SSH connection and supplying a path to the config file, but this won't work if you have to enter a passphrase. So, you can combine both approaches by making use of the --preserve-env flag:

sudo --preserve-env=SSH_AUTH_SOCK rsync -e "sudo --preserve-env=SSH_AUTH_SOCK -u $USER ssh" hostname:/source/path /destination/path

Note that it's necessary to cascade this flag through both sudo commands so it does look a bit messy!

Answer 5

As requested by Derek above:

when sudo asks for a password then you need to modify the sudoers config with sudo visudo and add a entry with NOPASSWD: in front of the rsync command.

For details you could consult man sudoers.

this will work in every mode, even via cron, at, systemd.service+timer, etc.

test it with: ssh <user>@<your-server> "sudo <your-rsync-command>"