To copy from production to standby over the internet I use a cron job
doing
My question is: should the cron job run on the production or the standby system.
Root access to the remote system is given by a pass phrase-less ssh key.

Currently I run rsync on the production system. I guess that it is more secure
because the standby needs no ssh login to production.

Running rsync on the standby would use less resources on production. I am concerned that in this case there would be pass phrase-less access from standby to production.

What is your experience?

I run it on the production system. I believe that the waiting time while transferring the data is relatively large, hence the average increase in system load should be small.

Besides, I think it is safer to make connection to the outside world from within your LAN than the other way around.

Why don't you use the -u switch?

jlinkels

Thank you jlinkels,
-u switch: rsync does not copy uptodate files even without -u switch.
Not sure, but I think -u affects how rsync decides what is uptodate.

Anyway I want to overwrite files even if soemone on the standby has changed a file.

Hi

I do it the other way. The production system needs to be exposed to the internet anyway, and with ssh on a non-standard port and keys only, it's fairly secure. Then the standby doesn't need to be exposed to the internet at all. Also, I use rdiff-backup on the standby to keep the old files for a month or so. The idea is that if even if the production system is compromised, it is not possible to destroy the standby.