Replication with Non-Root User on Target System

[koos5]

I need some help with replication between two TrueNas 12.0.U7 systems.

The local system will replicate to the remote system and the local system will PUSH to the remote.

On the remote system, there is a user rep with home directory as the parent for all replicated snapshots from the local system.

My understanding is that the replication task on the the local system runs as root on the local system, but that I should be able to configure the login into the remote system using any valid user account on the remote system.

Option 1: Connect to remote rep user

On the local system:

My understanding is that

key-pair
I created a ssh key-pair for user root and then added the public key to the user rep on the remote system.

ssh-connection
I then created a ssh-connection using the manual mode with the remote IP address, remote user rep and the key-pair that I created. During this process, the local system successfully retrieved the key of the remote system.

replication task

this is where I ran into problems. I selected the ssh-connection created, and then try to set the destination.
However, this always fail with an authentication error.
I can NOT browse the remote file system to set the target directory.

Option 2: Connect to remote root user

I add the public key to the root user on the remote system and create a new ssh-connection using the remote root user and the same key-pair that I created.
I select the new root ssh-connection and then I can set the destination.

The local system can successfully browse the remote file system to allow me to select the target directory.

Comments
Using the remote root user to login to the remote system is not acceptable.

What am I doing wrong trying to set up replication with a non-root user on the remote system?

Any help will be appreciated

 

[jgreco]

What am I doing wrong trying to set up replication with a non-root user on the remote system?

Well, I haven't looked at this on FreeNAS/TrueNAS recently, but the classic answer would be that you are losing root privilege, which is probably required for replication.

Typically, if you want to do stuff like rsync that needs to have root privileges in order to copy UID's/GID's/etc, you either do this via the root login, run an rsyncd daemon as root, or you write a wrapper executable in C that offers limited rsync capabilities via an unprivileged user. I've done all three over the years.

I'm guessing that relatively little thought has been given to avoiding the use of root during replication. There's relatively little value to avoiding it, seeing as how you can limit the executed command in the authorized_keys file.