I'm setting up an unattended rdiff-backup scheme and using Dean Gaudet's guide as, well, a guide. On the same wiki I also found an article that gave some instructions on how to modify that guide to use an alternate key. This supposedly fixes an issue whereby if you are logged onto the backup host and then ssh (from the shell) into one of the client machines as root, you end up invoking the rdiff-backup.

Reading the original guide some more, however, I see that it uses an ssh config alias to make the connection. Shouldn't this obviate the need for the alternate key? Am I missing something? Can someone explain this issue to me?

It appears that both guides are using a specific identity for the rdiff-backup, they are just using different methods.

Either way you implement it, you would need an alternate key if you want to be able to use public key authentication without having the rdiff-backup command run.

Are you saying that if I simply follow the original guide then I should be fine? That's what I understood after reading them closely. Not being an expert in either rdiff-backup or ssh, I thought that perhaps there was something that I was missing.

I don't have any experience with rdiff-backup, but the SSH part of the original guide makes sense to me. Give it a try and let me know if you run into any problems.

It worked. If I try to ssh as the backup user to root on the host "client" I get prompted for a password as I would expect. However, following the guide, if I create the ssh alias "backup-client" as described, the backup user can connect without a password. Many thanks!