This document describes the procedure to set up CA sync between two Zentyal servers. We will use for this rsync being run in a cron job.
We will use root in the side that starts the connection (provided script will be run by cron) and ebox for the side that receives it. We could use any other user, but using user ebox avoid having to create extra unneeded configurations. For the sake of the example we’ll be referring to two servers here:

1. (Server A) The server on which the CA existed previously, and from which the files for the CA will be taken.
2. (Server B). The secondary server to which we want to export the CA which exists on Server A.

In order to better understand the procedure we must keep in mind that:
Zentyal CA files are stored on /var/lib/zentyal/CA
This folder has these permissions:

ebox user has as his home the folder /var/lib/zentyal/

• With this information, we’ll proceed to follow these steps:Check that rsync is installed in server B, and if not install it.

• Check if root has a rsa key in server B. If it did not have, create if with ssh-keygen

 

• Create folder /var/lib/zentyal/.ssh/ and create file authorized_keys

• Chown both to ebox.ebox:

• Copy the root public key to /var/lib/zentyal/.ssh/authorized_keys of server A. Given ebox user has no password you will have to do it by hand, as long as you won’t be able to do it with ssh-copy-id . Thus, open /root/.ssh/id_rsa.pub and paste its contents into /var/lib/zentyal/.ssh/authorized_keys of server A.

• Test that you can ssh without using password from root as ebox user:

• Now you can:

1. Limit connections from IP:

To do so edit in SERVER A /var/lib/zentyal/.ssh/authorized_keys, and add prior to the ssh-rsa this:

2.  Ensuring that only rsync is used for this ssh connection:
To do so edit in SERVER A /var/lib/zentyal/.ssh/authorized_keys, and add prior to the ssh-rsa this:

Now, you must add the script it mentions this line (script taken from http://troy.jdmz.net/rsync/index.html)

If you use both, separate them with a “,”:

 

• Create the folder where you’re going to store the script that will do the sync and give it appropriate permissions:

 

• Create the script file and give it proper permissions:

 

• Place the following content on the script (change variables as needed)

 

• Test the script and confirm that it works as expected

 

• Create the cron job for the script we have just created. For instance, to run this daily write under /etc/cron.d/rsync-ca :