Test GNU tar's rmt-tar Remote Server Safely

rmt-tar is the quiet protocol server that lets GNU tar reach a file or tape device on another machine over SSH. The installed package here is GNU tar 1.35+dfsg-3ubuntu0.4, providing rmt-tar(8) at /usr/sbin/rmt-tar and an rmt alternative. Allow about 15 minutes if SSH access already works.

This is a protocol server, not a browsing tool: it reads requests from standard input and writes replies to standard output, so do not run it in a terminal expecting a prompt back. Access to a real tape device may need elevated privileges on the remote host; the verification steps below do not.

1. Check the installed server

Run these ordinary, read-only commands on the host that will provide the remote device:

$ command -v rmt-tar
/usr/sbin/rmt-tar
$ command -v rmt
/usr/sbin/rmt
$ tar --version | head -2
tar (GNU tar) 1.35

Your paths may differ. Check both the canonical executable and the name exposed through the system's alternatives mechanism:

$ readlink -f /usr/sbin/rmt
/usr/sbin/rmt-tar

Checkpoint: the program has to exist on the machine that actually owns the archive file or tape. Installing it only on the client running tar gets you nowhere.

2. Learn the request framing

Each request starts with a single command letter. An argument follows on the same line when the manual shows one, and further arguments or data follow on their own lines as documented. The letter must touch its first argument directly: O/path/to/file, never O /path/to/file with a space.

O opens a device or file with open flags, closing anything already open.
C closes the current device; any text after the letter is ignored.
L seeks, using a whence value and offset.
R reads a requested number of bytes, while W writes that many bytes supplied right after the request.
I sends a tape operation through MTIOCOP, and S returns status from MTIOCGET.

A successful reply starts with A and a decimal result. An error starts with E, an errno number and a one-line message. The protocol is binary-safe for data returned by an R request, so never route it through a text filter.

3. Verify open and close on a harmless file

Use a temporary regular file so nothing real is at stake. mktemp creates it, the open request opens it read-only, and close finishes the session. This only touches a temporary path in /tmp and needs no sudo:

$ test_file=$(mktemp /tmp/rmt-check.XXXXXX)
$ printf 'O%s\n0\nC\n' "$test_file" | /usr/sbin/rmt-tar
A0
A0

The first A0 confirms the open, the second confirms the close. That 0 is the numeric open flag for read-only access on Linux. Keep the temporary file until you are done testing, then remove that exact file with rm -- "$test_file". If your shell will not retain the variable, print the path and confirm it with test -f before removing it explicitly.

Checkpoint: an E reply means check the request spelling first. An inserted space after O makes the server look for an entirely different path. If the open succeeds but a later command reports a bad file descriptor, the request stream was malformed or the device was already closed.

4. Exercise write, seek and read

Now use symbolic flags and a short payload. The write request is followed immediately by exactly five bytes, and the seek request supplies whence and offset on separate lines:

$ test_file=$(mktemp /tmp/rmt-check.XXXXXX)
$ printf 'O%s\nCREAT|TRUNC|RDWR\nW 5\nhelloL 0\n0\nR 5\nC\n' "$test_file" | /usr/sbin/rmt-tar
A0
A5
A0
A5
hello
A0

Reading the replies in order: open succeeded, five bytes were written, the seek landed at offset zero, five bytes were read, those bytes came back, close succeeded. The installed GNU implementation accepts symbolic O_* names without the O_ prefix and treats | as bitwise OR; BSD variants may only accept decimal flags, so do not assume this extension when testing a different implementation.

Warning: never substitute a production path into this test. CREAT|TRUNC creates a file and discards whatever was in it. If a test fails partway through, check the exact temporary path carefully before removing it, and only remove it once you have confirmed it is disposable.

5. Let tar start rmt-tar over SSH

GNU tar normally starts the remote server through rsh or a compatible remote-shell command whenever the archive name has the shape host:file. Prefer SSH for a real connection, and confirm the remote account can actually execute the server:

$ ssh BACKUP_USER@BACKUP_HOST /usr/sbin/rmt-tar

This looks like it hangs because rmt-tar is genuinely waiting for protocol input. Stop it with Ctrl-C. A successful connection proves transport and execution work, nothing more about tape access.

For a read-only archive listing, point tar at the remote archive:

$ tar --rsh-command=ssh --rmt-command=/usr/sbin/rmt-tar \
    -tf BACKUP_USER@BACKUP_HOST:/srv/backups/example.tar

Only pass --rmt-command when the server is not at the path your tar was built to expect; skip it if the default already matches. Reading an archive is the safer first test. Creating one, or operating a tape, writes remote state, so confirm the target path and media before you reach for -c, -w or a tape write operation.

Common traps

SSH failure before rmt-tar even runs. Test the account and path separately with the commands below; each should come back clean.
Confusing an E reply with a broken connection. An E response is an operation failure from the server itself. A missing command, rejected login or stray login-shell output is a different problem: remote execution, not the protocol.
Shell profile banners corrupting the conversation. The server's standard output belongs entirely to the protocol; keep non-interactive startup noise off that channel.
Reaching for sudo or setuid on a permissions error. Use it only for a deliberate, audited device-access test on the remote host. The manual itself discourages using rmt as a general-purpose remote file tool: use SSH and normal permissions for ordinary file transfer instead.

$ ssh -T BACKUP_USER@BACKUP_HOST 'command -v /usr/sbin/rmt-tar; id'
$ ssh BACKUP_USER@BACKUP_HOST 'test -x /usr/sbin/rmt-tar && echo executable'
executable

Done means

Confirmed the remote host has the expected GNU tar version and an executable rmt-tar.
Ran a temporary-file session that returned the expected A replies for open, write, seek, read and close.
Executed the server over SSH with no extra standard-output text getting in the way.
Succeeded at a read-only tar listing before attempting any remote archive or tape write.
Limited real device access to the required account and permissions, and removed every disposable test file.