Hmm, interesting, basically an rsync wrapper. I was also thinking: How about an unprivileged account with sudo access to run rsync as root? I found this discussion:
http://lists.samba.org/archive/rsync/2004-August/010439.html Turns out that is also in the BackupPC FAQ: http://backuppc.sourceforge.net/faq/ssh.html If you are tunneling the rsync command through an ssh shell, then why would rsyncd with plain passwords be used at all? rsync would be run within the shell on the "client", ssh does the authentication (preferably by keys) rsyncd would not be used at all. tcp_wrappers and / or iptables can be used to reinforce restrictions in case somebody figures out a way to fool rsync or try spoofing / man-in-the-middle. The unprivileged account could have a restricted shell as the shell to limit which commands could be accessed. You should also use the complete absolute path and avoid adding layers of shell scripting to avoid e.g. a rootkit that adds to $PATH to redirect commands to new ones installed by the kit, also avoid reference to env variables. Joe Krahn wrote: > Here is a first draft at an rsync proxy command for access control on > the client computer (as an attachment; I hope that's OK). I think that > remote root access is probably more secure than a non-privileged ssh > tunnel, because that still relies on a plain rsyncd password for security. > > This is a Perl script that gives very limited access control. You can > restrict the read and write access paths, and it automatically rejects > paths with "/../". It restricts the rsync arguments, and may need > adjustment if you want arguments like "--backup-suffix=...". It also > executes rsync in a way that avoids sh processing. > > There are many possibilities for developing this further. Comments are > welcome. > > Joe Krahn > > ------------------------------------------------------------------------ > > ------------------------------------------------------------------------- > This SF.net email is sponsored by: Microsoft > Defy all challenges. Microsoft(R) Visual Studio 2008. > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ > ------------------------------------------------------------------------ > > _______________________________________________ > BackupPC-users mailing list > [email protected] > List: https://lists.sourceforge.net/lists/listinfo/backuppc-users > Wiki: http://backuppc.wiki.sourceforge.net > Project: http://backuppc.sourceforge.net/ ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ BackupPC-users mailing list [email protected] List: https://lists.sourceforge.net/lists/listinfo/backuppc-users Wiki: http://backuppc.wiki.sourceforge.net Project: http://backuppc.sourceforge.net/
