59

Having a problem that rsync does not set UID and GID as expected, my gut feeling is that rsync should be run as root on the destination machine.

I can't login as root via SSH, since that's disabled for security purposes. The user on the destination machine is able to use sudo.

Is it possible to use rsync with sudo?

118

On the destination machine

  1. Find out the path to rsync: which rsync
  2. Edit the /etc/sudoers file: sudo visudo (see also: must I use visudo?)
  3. Add the line <username> ALL=NOPASSWD:<path to rsync>, where username is the login name of the user that rsync will use to log on. That user must be able to use sudo

Then, on the source machine, specify that sudo rsync shall be used:

rsync ... --rsync-path="sudo rsync" ...

Using it without the NOPASSWD on the destination machine will result in the message

sudo: no tty present and no askpass program specified

9
  • 4
    Thanks, only I use pki so I used -e="ssh -i $PRIVATE_KEY_PATH" --rsync-path="sudo rsync" – A T May 15 '17 at 6:01
  • 2
    Of course <username> can now read/write everything as root using rsync, locally and remote, so the part about not being able to log in as root due to security concerns is kinda moot... cause essentially you're doing that now. – hmn Aug 2 '18 at 21:16
  • 1
    @hmn: not exactly. Disabling root access on SSH basis will prevent some brute force login attacks. In my case, I log on with a keyfile and I need a different password for that than for the sudo command. sudo does quite a good job protecting us, e.g. you cannot have an open root shell forever and it gives you logging. I personally like it. – Thomas Weller Aug 3 '18 at 6:25
  • 2
    Still getting the "not tty present..." error after following these instructions? I was. Making sure the line I added to /etc/sudoers comes at the end of the file (or after any group rules which may affect the same user) solved the problem for me. – CPBL Jan 28 '19 at 1:15
  • 2
    I'm using this solution but would like to improve security by restricting the args the user can pass to rsync on the destination server. Typically I would limit the args that can be used with <username> ALL=NOPASSWD:<path to rsync> <args> but I don't know what the args would be when called remotely like this. Any ideas? – Pete Cornell Sep 12 '19 at 1:00
5

My solution is to use --rsync-path="sudo rsync", if it ask for password you can use workaround like this:

rsync -avz --stats --rsync-path="echo <SUDOPASS> | sudo -Sv && sudo rsync"  user@192.168.1.2:/ .

But this is not secure to put a password in command line.

1
  • This works great to pull between ec2 instances (minus the echo <SUDOPASS> part). Dont forget to add a Security Group rule to allow port 22 from the sgID itself, to the instances that need it. rsync -aPvhe ssh -A --rsync-path="sudo -Sv && sudo rsync" ec2-user@<privateEC2-IP>:/home/ec2-user/testfile /home/ec2-user Note, the testfile was 700 root:root and this copied the file while maintaining permissions. – semtex41 Dec 15 '20 at 21:09
4

You can have the remote sudo ask you for your password through X-windows. Here's a way to do that:

  1. Make sure ssh-askpass is installed on the remote host (and that you are using X-windows, of course)
  2. Make sure this is in /etc/sudo.conf:
# Path to askpass helper program
Path askpass /usr/bin/ssh-askpass
  1. Add these options to rsync: -e "ssh -X" --rsync-path="sudo -A rsync"

    • ssh -X will forward your X-windows information and port to your remote session
    • sudo -A will make sudo use ssh-askpass to ask you for your password
1
  • Works on Ubuntu 18; create /etc/sudo.conf (if it does not already exist) on the destination m/c – Snidhi Sofpro Nov 20 '19 at 14:09
0

If there is no access to sudoers file, just create a wrapper script for the ssh command.

ssh_sudo:

{ 
  echo $PASSWORD;
  cat - ;
} | ssh $* &

At first, this passes the password to the ssh client's sudo process in order to start rsync on the remote side. Next all input coming from the local rsync is piped to ssh.

Finally call rsync e.g. with:

PASSWORD=<SUDOPASS> rsync -avzue ssh_sudo --rsync-path "sudo -S rsync" SRC DST

I guess the security aspect here is not that bad, you'll only have to save the password locally as env var. Reading it from a file should work as well...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.