Server backups with rsnapshot, rsync, non-root user

This article explains how to do system backups of Linux systems without leaving root ssh access open.

First, download rsnapshot from

Use ssh-keygen to create public key ( as the backup user on the rsnapshot server.
Scp to /backupuser/.ssh/authorized_keys2 on the remote system to be backed up.
The backups only connect to do a “pull” of data from each remote system to the host server.

rsnapshot.conf configuration:

rsync_long_args -ev --rsync-path=/usr/bin/
ssh_args -i /home/backupuser/.ssh/id_rsa

# Add a line for each remote system to back up:
backup backupuser@systemname:/. systemname/

See ‘man rsnapshot’ for info, or

Deploying rsnapshot:

* Create user on each system:
/usr/sbin/useradd backupuser -c "limited backup user" -m -u 10000  # pick a unique id across all systems
* Create ssh public key with customized access rules on backup server as the backup user. Change first line:  from="ipaddress", command=" " ssh-rsa...
* Scp the public key (or authorized_keys2) from backup server to clients at /home/backupuser/.ssh
* Add limited sudo rights for backup user to rsync
* Copy to each system under /usr/bin (included via cfengine)

/usr/bin/sudo /usr/bin/rsync "$@";

* Optional: use ‘’ script and copy to backupuser’s home on each system. Add to “command=” line in ssh key.
* Configure each backup line in rsnapshot.conf to run the backup as the backupuser
* Check your configuration: sudo rsnapshot configtest will check /etc/rsnapshot.conf for syntax
* To “initialize” the key, you may need to run this manually once from the backup server:
sudo ssh -i /home/backupuser/.ssh/id_rsa backupuser@servername

using a nonstandard port:

For servers with ssh on a nonstandard port, create this ssh config file with options for a particular server: /home/bkupuser/.ssh/config. (In this case, the file needs to be created under root’s .ssh folder, even though it will be run as a backup user)

Host servername
User bkupuser
Port 2222

Debian difference:

Copy public key as “authorized_keys” (not authorized_keys2) and add fully qualified domain name to the end of the ssh key.

Useful Links that may help:

[Using Rsync and SSH|]

[Remote Filesystem Snapshots with rsnapshot|]

[Remote rsnapshot backups with non-root user|]