## allow rsync to access /var/mirror, this is really not sufficient, but
## the real check is done on the ``ssh-cmd-validate`` side.

rsync ALL=(root) NOPASSWD: /usr/bin/rsync --server * . /var/mirror/*

%rsync ALL=(root) NOPASSWD: /usr/local/sbin/ssh-key *
%rsync ALL=(root) NOPASSWD: /usr/local/sbin/ssh-update-keys