I would like to transfer some files from a server A to a server B daily (for backup purposes). However, I cannot find a way that does not create security breaches. My goal is that someone with sudo rights on server A cannot exploit this transfer to connect to server B.
My base idea was to do a cronjob with a
scp (or similar) command in it. Obviously, using a password-based SSH connection between A and B does not work, and using a key-based SSH connection would, as far as I know allow a user of server A to connect directly to B via A.
I'm no security expert, I may be missing the obvious here. Is there a way to achieve what I want?
I do not want users of server B to be able to connect to server A either.
user@serverB:~/: rsync -avz serverA:/path/to/file /local/path/to/store/. Another way is to setup a third instance that is able to login via SSH to the both servers and use
scpto copy directly from A to B (this is not supported by
rootuser account you need to rethink your user access control rules. In most cases, you need to set up a different user account with restricted access to exactly those privileged actions that the user needs to have.