zuul is getting low on disk space. It jumps up to 95% used every time it syncs the #Bacula database. I decided to use 2 other #FreeBSD hosts instead.
Didn't take long to create the rsyncer user & copy over the scripts. Added entries to /etc/hosts and ~/.ssh/authorized keys
Ran script. Looked at /var/log/auth.log on remote host to find:
Authentication tried for rsyncer with correct key but not from a permitted host (host=r720-02.example.org, ip=10.8.5.140, required=r720-02.example.net,10.140.5.217).
Good. Helpful.
Copied/pasted that 'r720-02.example.org, ip=10.8.5.140' into authorized keys (removing ip=):
from="r720-02.example.org, ip=10.8.5.140",command="/usr/local/sbin/rrsync /usr/home/rsyncer/backups/bacula-database/postgresql/" ssh-ed25519 A..[rest of key redacted]
Ran script.
Success.
Repeat with other host, same issues, but no connection obtained.
Adjust firewall rules to allow incoming ssh from this host (tightly restricted host which also is the portal to hosts in the basement) into the basement LAN.
All in all, good time spent after waking up early today.
If you want to know more about restricting ssh keys to rsync only, see:
https://dan.langille.org/2017/07/15/anvil-copying-the-certificates-to-the-website/