Syncing Distribution Points

[monosodium]

I've got a problem that I just cannot fix and am hoping someone here has a good solution. I have 3 Distribution points, 2 secondaries and one master. Trying to get them to sync through an Rsync script has been a nightmare though. I have tested SSH and verified that I can connect from the secondaries to the primary without requiring authentication.

I know that the script itself works, because if I run it manually via casper remote on one of the servers it works. But when I try to run it via policy I get a very non-descriptive error (at least to me):

"Script result: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive).
rsync: connection unexpectedly closed (0 bytes received so far) [receiver]
rsync error: unexplained error (code 255) at /SourceCache/rsync/rsync-42/rsync/io.c(452) [receiver=2.6.9]"

My script is:

sudo rsync -azvrpu -e ssh --delete ssh_user@secondary_distribution_server:"/Volumes/Striped Raid Set/Casper Distribution Point/" "/Shared Items/Casper Distribution Share/"

Seems pretty basic... but I have no idea what to do after weeks of troubleshooting. My goal here is to just have the syncing occur every night at 2 AM or so. I am not set on rsync particularly, and would be open to any free software that does this automatically.

[chris_kemp]

Running the software via policy is going to run it as root. Try running the script as a cron job with the casperadmin user.

[franton]

I'd suggest reading http://www.askapache.com/security/mirror-rsync-ssh.html. This is pretty much (except for the cron bit) what we have.

[gregp]

We use rsync from each of the remote dist points to pull from the master server. Its scheduled in launchd to run as root & don't use ssh (using the native rsync protocol). In rsyncd.conf on the server, there are restrictions to be read-only and only specific hosts have access. The traffic isn't encrypted, but that's not a problem here. Also don't have any spaces specified in the paths on the command line.

Been running that way for years to a dist point on the wrong side of a slow WAN and with a pair of others on the other side of the planet.