how should I (best practice) set up permissions for rsync ?

[Erik Norgaard]

user wrote:
> I want to rsync /usr/home from one machine to another, for purposes of
> backup.
> 
> This would be a cinch if I just rsyncd -e ssh, as user "root" from one
> machine to another.  The cron job runs with root perms, and the
> destination machine gets logged into as root and can write into the
> destination /usr/home.
> 
> However, I sort of like the idea that root cannot ssh directly into a
> freebsd machine, by default.  I am inclined not to change this.
> 
> I also would like to keep default /usr/home permissions as they are.

1st: you could reverse the connection so the backup machine fetches from 
the server, this means that the user that logs into the server only need 
read access.

2nd: maybe you want to have incremental backups so you can go back a 
number of days? I don't know your system, but it happens that users 
delete some vital file and don't get it restored right away.

You can create a tar-archive preserving owner, group and permissions.

In that case, your server should push the archive to the backup host 
otherwise you may get problems with clocks not being in sync or backup 
on the server not finishing before the backup is fetched.

The advantage is that you can create the tar archive as root, change 
owner/group and send it to the backup host using ssh and login to a 
restricted account.

I worked as an administrator, the backup policy was:

* full backup on tape on weekdays, that is at night when activity
   is low, change tape every day
* backup only changes during weekends, same tape (the friday tape)
* latest two backup tapes stored on external site
* tapes cycled with 2 weeks interval, every fortnight the daily
   backup was queued in the two week backup line with longer storage
   time before the tape was recycled.

Now, this is a quite expensive backup policy. Just FYI.

Cheers, Erik