Re: rssh security update breaks rsync via Synology's "hyper backup"

2019-02-19 Thread Chris Lamb
Hi Russ, > I've not done an LTS security upload before, but it looks from the wiki > that it uses the same security-master process as stable security updates. > Please let me know if that's wrong. This is mostly correct, yep! I made the following the changes to your jessie diff: - * The fix f

Re: heads up: DLA should now be published on the website

2019-02-19 Thread Holger Levsen
On Mon, Feb 18, 2019 at 04:10:47PM -0500, Antoine Beaupré wrote: > > can you please put that on wiki.d.o/LTS/Development?! > This is now done. I added a new section to the wiki awesome, thank you! > I've done one more mass import, hopefully the last: > https://salsa.debian.org/webmaster-team/webw

Re: rssh security update breaks rsync via Synology's "hyper backup"

2019-02-19 Thread Roman Medina-Heigl Hernandez
El 19/02/2019 a las 4:16, Russ Allbery escribió: > Unfortunately, I took a closer look, and it turns out that this command > was never safe. It also allows arbitrary code excution on the server > side if the client can write to $HOME. This is because: > >--config=FILE > This specif

Re: rssh security update breaks rsync via Synology's "hyper backup"

2019-02-19 Thread Russ Allbery
Roman Medina-Heigl Hernandez writes: > Well, in my case I had the following setting in rsyncd.conf: > path = /backup/synology > where path points to a different directory which is NOT $home nor > doesn't permit to reach $home. > So you cannot overwrite /home/synology/rsyncd.conf. Can the clie