On the right lines. Though that particular command won't work because the `&& rsync` will be interpreted by your own shell (and it's missing a command argument).

You'll probably find that `sudo -u govuk-backup rsync` works and so does `sudo -u govuk-backup cat /etc/passwd`. Because they are simulating a real login or invoking rssh.

However `sudo -iu govuk-backup rsync` will simulate a login. Or to be absolutely certain, you can replace hiera's `base::user::ssh_key` with your own pubkey and try `rsync somefile govuk-backup@172.16.10.10:`.

Besides allowing rsync, what other methods does `rssh` support and do we prevent those?