How safe is this remote rsync setup?

Question

I'm thinking about security, I've done a specific setup to run rsync over internet and was thinking about security, this is the setup:

• Destination server has an SSH jail user only with bash and rsync, with a mounted folder called files that contains files, and nothing more.

• Source server runs:

  rsync [params] /source -e "ssh -p [port]" destjaileduser@destinationserver:/files/
  

If someone discovers the password of the jailed user, they can only run rsync, nothing else (rsync is needed for remote sync, can't remove).

Question is: Is it possible for this jailed user to make his way out of the jail and access the system by any way, since he is limited? If yes, what can be done to prevent it?

The only thing I thought that the user could do is to place some program in rsync source and run rsync to send it to the server, but could the user do anything, since he is jailed and can't see the real system? The files, if affected by ransomware or wiped out, no problem, they have cryptography and are copied to another place that the jailed user can't see.

Am I doing things right?

Answer 1

Your defensive approach should focus on remote access to the server

Required daemon programs should be up to date
Not-required ones should not be installed

You could secure ssh with iptables, authentication keys and why not 2FA authentication. See this article : https://devops.ionos.com/tutorials/secure-the-ssh-server-on-ubuntu/

You may also implement the fail2ban program which is an efficient way to dynamically feed the iptables network filter from login attemps. https://help.ubuntu.com/community/Fail2ban