Verified Commit 3561a383 authored by Evangelos Foutras's avatar Evangelos Foutras 🐱
Browse files

Use restrict key option and relative borg command

No functional change; the "restrict" key option is a shorthand for:

- no-agent-forwarding
- no-port-forwarding
- no-X11-forwarding
- no-pty
- no-user-rc

It was added in OpenSSH 7.2 (2016-02-29) as a convenient way to specify
an authorized key should have "all current and future key restrictions"
applied to it.

Also switch to a relative borg command since its location is not really
standardized; on rsync.net it appears to be located under usr/local/bin
(though /usr/bin/borg works too, even if it doesn't exist!) and Hetzner
just forces its own command, ignoring ours. 🐱

The Borg documentation seems to agree with both the above alterations:

[1] https://borgbackup.readthedocs.io/en/stable/usage/serve.html
parent 3fa8851a
...@@ -37,5 +37,5 @@ ...@@ -37,5 +37,5 @@
user: borg user: borg
key: "{{ item.stdout }}" key: "{{ item.stdout }}"
manage_dir: true manage_dir: true
key_options: "command=\"/usr/bin/borg serve --restrict-to-path {{ backup_dir }}/{{ item['item'] }}\",no-pty,no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-user-rc" key_options: "command=\"borg serve --restrict-to-path {{ backup_dir }}/{{ item['item'] }}\",restrict"
with_items: "{{ ssh_keys.results }}" with_items: "{{ ssh_keys.results }}"
...@@ -13,5 +13,5 @@ ...@@ -13,5 +13,5 @@
# Client machines keys # Client machines keys
{% for client_key in client_ssh_keys.results %} {% for client_key in client_ssh_keys.results %}
command="/usr/bin/borg serve --restrict-to-path {{ backup_dir }}/{{ client_key['item'] }}",no-pty,no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-user-rc {{ client_key['stdout'] }} command="borg serve --restrict-to-path {{ backup_dir }}/{{ client_key['item'] }}",restrict {{ client_key['stdout'] }}
{% endfor %} {% endfor %}
...@@ -13,5 +13,5 @@ ...@@ -13,5 +13,5 @@
# Client machines keys # Client machines keys
{% for client_key in client_ssh_keys.results %} {% for client_key in client_ssh_keys.results %}
command="/usr/bin/borg serve --restrict-to-path {{ backup_dir }}/{{ client_key['item'] }}",no-pty,no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-user-rc {{ client_key['stdout'] }} command="borg serve --restrict-to-path {{ backup_dir }}/{{ client_key['item'] }}",restrict {{ client_key['stdout'] }}
{% endfor %} {% endfor %}
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment