How can I allow the user "postgres" on one server to rsync to another?

Assuming your slave server allows key authentication, you only need to update /etc/ssh/sshd_config if you've set AllowedUsers, in which case you need to ensure postgres is in that list.

Other than that, just ssh-keygen (leave private key passphrase empty), and then add an ~/.ssh/authorized_keys directory/file to the slave server. The home directory for postgres is /var/lib/postgresql, but if you do these operations while su'd as the postgres user, you can just use ~, not to mention you won't have to chown anything, because postgres will own the generated ssh keys on the master server, and postgres will own the created directory/file on the slave server.

Be sure to set the file permissions securely on both the master and slave server:

# On master
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_rsa.pub
chmod 600 ~/.ssh/known_hosts  # this one won't exist until you SSH once

# On slave
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

You need following entry in sshd_config of server2:

AuthorizedKeysFile  .ssh/authorized_keys

Disabling selinux system wide is a poor solution.

It's much better to create a policy module that will allow the specific action you need.

Here is what I did in RHEL6:

I cleared my audit log, restarted rsyslogd, and repeated the issue.

Next, use audit2allow to see the human readable problem:

# audit2allow -w -a
type=AVC msg=audit(1438288591.000:8525): avc:  denied  { open } for  pid=6063 comm="sshd" path="/var/lib/pgsql/.ssh/authorized_keys" dev="dm-0" ino=920234 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:postgresql_db_t:s0 tclass=file
        Was caused by:
                Missing type enforcement (TE) allow rule.

                You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1438288591.000:8525): avc:  denied  { read } for  pid=6063 comm="sshd" name="authorized_keys" dev="dm-0" ino=920234 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:postgresql_db_t:s0 tclass=file
        Was caused by:
                Missing type enforcement (TE) allow rule.

                You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1438288591.000:8526): avc:  denied  { getattr } for  pid=6063 comm="sshd" path="/var/lib/pgsql/.ssh/authorized_keys" dev="dm-0" ino=920234 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:postgresql_db_t:s0 tclass=file
        Was caused by:
                Missing type enforcement (TE) allow rule.

                You can use audit2allow to generate a loadable module to allow this access.

After making sure there were no extra denials going on, and that these were specific to the issue at hand, create an selinux module to allow sshd to read, open, and getattr for postgres authorized_keys:

# audit2allow -a -M sshd_read_postgres_ssh_authorized_keys

Now install the resulting module:

# semodule -i sshd_read_postgres_ssh_authorized_keys.pp

I copied this module to the peer postgres server and installed there as well. I can now ssh with public key authentication between boxes as postgres, and I am still in an selinux enforcing state.

You can turn on debug logs on your existing ssh server. In file /etc/ssh/sshd_config change LogLevel DEBUG3 if the reason for unsuccessful login is Could not open authorized keys '/var/lib/pgsql/.ssh/authorized_keys': Permission denied and access rights to authorized_keys seems ok, then this command will help

restorecon -FRvv /var/lib/pgsql/.ssh/

explanation

I found Gregory's answer only partially worked for me, although it pointed me in the right direction. I found a few rules/policies were needed, and could only be generated in a specific order.

Since the ssh-copy-id command only works if the the other end has a password, you will need to scp the public key around and adjust the user and permissions accordingly. This way no password needs to be created and one possible access point is kept closed.

To create a postgres user key and allow it to ssh into itself, but if you carry that key to another server it will also work.

# su postgres
$ cd
$ ssh-keygen # [enter....] * 
$ cd .ssh/
$ cp id_rsa.pub authorized_keys
$ chmod 0600 authorized_keys 

Each error needs occur before a rule can be generated for it, therefore after every policy added another attempt to ssh with just enter on the password prompts is needed.

$ ssh [email protected] 

ssh into self for simplicity, but it still works. After it errors:

$ exit
# audit2allow -a -M sshd_open_postgres_ssh_authorized_keys
# semodule -i sshd_open_postgres_ssh_authorized_keys.pp
# su postgres
$ ssh [email protected] 
$ exit
# audit2allow -a -M sshd_read_postgres_ssh_authorized_keys
# semodule -i sshd_read_postgres_ssh_authorized_keys.pp
# su postgres
$ ssh [email protected] 
$ exit
# audit2allow -a -M sshd_getattr_postgres_ssh_authorized_keys
# semodule -i sshd_read_postgres_ssh_authorized_keys.pp
# su postgres
$ ssh [email protected] 

should work this time

NOTE: '#' indicates root, but use sudo, I wrote it this way for ease - not to indicate best practices

SELinux was causing this issue for me on Redhat 6.5. Fixed using:

setenforce Permissive