From cf1c73b4f94fc8a4529d5e0c3f00ea167861fd51 Mon Sep 17 00:00:00 2001 From: Simon Heath Date: Sun, 2 Oct 2016 17:14:34 -0400 Subject: [PATCH] Added docs explaining multiple --restrict-to-path flags, with example (take 2) --- borg/archiver.py | 3 ++- docs/deployment.rst | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/borg/archiver.py b/borg/archiver.py index ce7655fc5..785a98a6d 100644 --- a/borg/archiver.py +++ b/borg/archiver.py @@ -1011,7 +1011,8 @@ class Archiver: help='start repository server process') subparser.set_defaults(func=self.do_serve) subparser.add_argument('--restrict-to-path', dest='restrict_to_paths', action='append', - metavar='PATH', help='restrict repository access to PATH') + metavar='PATH', help='restrict repository access to PATH. ' + 'Can be specified multiple times to allow the client access to several directories.') subparser.add_argument('--append-only', dest='append_only', action='store_true', help='only allow appending to repository segment files') init_epilog = textwrap.dedent(""" diff --git a/docs/deployment.rst b/docs/deployment.rst index 3c76500fe..b4794300a 100644 --- a/docs/deployment.rst +++ b/docs/deployment.rst @@ -54,6 +54,11 @@ Restrictions Borg is instructed to restrict clients into their own paths: ``borg serve --restrict-to-path /home/backup/repos/`` +The client will be able to access any file or subdirectory inside of ``/home/backup/repos/`` +but no other directories. You can allow a client to access several directories by passing multiple +`--restrict-to-path` flags, for instance: ``borg serve --restrict-to-path /home/backup/repos//root --restrict-to-path /home/backup/repos//home``, +or instead simply use `--restrict-to-path` once to restrict the client to ``/home/backup/repos//*``. + There is only one ssh key per client allowed. Keys are added for ``johndoe.clnt.local``, ``web01.srv.local`` and ``app01.srv.local``. But they will access the backup under only one UNIX user account as: ``backup@backup01.srv.local``. Every key in ``$HOME/.ssh/authorized_keys`` has a