From owner-freebsd-questions@FreeBSD.ORG  Fri Oct 29 12:22:24 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B09B716A4D1
	for <questions@freebsd.org>; Fri, 29 Oct 2004 12:22:24 +0000 (GMT)
Received: from iota.root-servers.ch (iota.root-servers.ch [193.41.193.195])
	by mx1.FreeBSD.org (Postfix) with SMTP id 88A4C43D48
	for <questions@freebsd.org>; Fri, 29 Oct 2004 12:22:23 +0000 (GMT)
	(envelope-from gaml@buz.ch)
Received: (qmail 43300 invoked from network); 29 Oct 2004 12:22:21 -0000
Received: from 80-218-104-238.dclient.hispeed.ch (HELO ga) (80.218.104.238)
  by 0 with SMTP; 29 Oct 2004 12:22:21 -0000
Date: Fri, 29 Oct 2004 14:23:56 +0200
From: Gabriel Ambuehl <gaml@buz.ch>
X-Priority: 3 (Normal)
Message-ID: <689835538.20041029142356@buz.ch>
To: questions@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Subject: Read only access to ALL files? Or: how do I safely backup the
	complete system to an offsite machine?
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: Gabriel Ambuehl <gabriel_ambuehl@buz.ch>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 29 Oct 2004 12:22:24 -0000

Hi,
I'm wondering if there is any way to have read only access to the whole
system for an user on STABLE (I have some ideas how to achieve it on
CURRENT but I don't consider that ready for production use just now)?

Specifically, I want to be able to ssh in from the backup server and
fetch all files with rsync without having to give the backup server
full root access to all other machines (for obvious reasons).

There's obviously a hack involving NFS and read only/maproot=root
but seeing that the backup server is offsite, I have to use ssh for
transport and would rather not resort to VPN hackery...

Or maybe someone knows of a rsync version that is safe to be run a
suid root as it won't ever change anything on the filesystem?


Regards,
Gabriel