I like to synchronize photos taken with my Android phone with my notebook, and since I dislike centralized solutions (mostly for reasons of privacy), I installed rsync for Android, which is easy to install from Play Store, and with SSH public key authentication, syncing the images is easy and secure at the same time.
My problem was that still hadn't collected enough information to trust my phone with powerful public keys (even though I use APG, I only added public keys so far), and having a key on my phone that could allow anyone to log into my notebook through SSH was unacceptable for me, even though I set up a separate user account, and SSH wasn't set up to start at boot.
To solve this problem, I logged what command the application started upon
connecting via SSH, and added the following line to the authorized_keys file
in the .ssh subdirectory of the home directory of the dedicated user (foo).
The lines are split only for easier readability, there should be no line break
or whitespace between no-port-forwarding, and no-agent-forwarding.
command="rsync --server -vlHDtre.i . /home/foo/images",no-port-forwarding,
no-agent-forwarding,no-X11-forwarding,no-pty ssh-dss AAAA...
This way, the private key on the phone can only be used for rsyncing a specific directory, and cannot be used to
- open a shell or start any other program, or
- forward TCP ports, SSH agent or X11 connections from/to my notebook.
Thanks to rhapsodhy for the inspiration.