Re: [gentoo-user] Is there a way to automate rsync of updated portage tree across multiple boxes without each having to pull it down from a gentoo mirror

[Vaeth]

On Mon, 15 Sep 2008, Michael Sullivan wrote:
> On Mon, 2008-09-15 at 16:17 +0200, Alan McKinnon wrote:
> > On Monday 15 September 2008 16:09:42 Michael Sullivan wrote:
> > > Is there a way to do this?  The problem with my
> > > theories on how to do this fall apart when I get to the part where a
> > > password has to be entered for rsync/scp.
> >
> > ssh keys. [...]
> Create ssh keys without passphrases?  That's not recommended...

It depends: If you use these keys for nothing else than to login to
your "server" machine (to fetch the portage tree) (and of course if
you keep the key readable only for the cron-job on the client) then
the only risk you have is: If the client (or the user for the cron-job)
gets compromised then also the server might get compromised/spied to some
extend (depending on which permissions allows the server to the account
which you use for syncing, i.e. which is accepting the corresponding
ssh key).

But this risk is always there, no matter which approach you choose...

An alternative - if you really just want to use keys with a passphrase -
is to use net-misc/keychain. Of course, this means that you have to
(manually) enter the passphrase at least once after booting or otherwise
your cron-job will fail.

> > and if you use eix to run update-eix afterward

I would even recommend to use eix-sync to do all in the correct order:
Call it on the client side with option "-s user@server[:dir]"
(or put the line with this option into /etc/eix-sync.conf if you want
to use this option practically always); this supports even keychain:
Put e.g. the line
~keychain --quiet ~/.ssh/id_rsa ; cat ~/.keychain/"$(hostname)-sh"
into /etc/eix-sync.conf; see the eix manpage and eix-sync -h for details).

An alternative might be to use option "-2 ..." on the server side,
but this supports currently _one_ client and requires that eix-sync -u
(or at least update-eix) is called afterwards on the client side.