Re: Secure rsync setup, bind-mount ro

2006-12-19 Thread Dariush Pietrzak
> Debian packages... But let me qualify my statement. "Bind mounts are > just an aliasing mechanism in default kernels as distributed with any > major distribution I looked at." Satisfied? Nope, they are not an aliasing mechanism, otherwise it would be impossible to do the thing you've just seen.

Re: Secure rsync setup, bind-mount ro

2006-12-19 Thread Lupe Christoph
On Tuesday, 2006-12-19 at 08:47:32 +0100, Dariush Pietrzak wrote: > On Mon, Dec 18, 2006 at 04:50:51PM +0100, Lupe Christoph wrote: > > when I mean bind mounts. No, they are just an aliasing mechanism. > Nope, they're not: Well, we are on a Debian mailing list, so I'd assume we talk about Debian

Re: Secure rsync setup, bind-mount ro

2006-12-18 Thread Dariush Pietrzak
On Mon, Dec 18, 2006 at 04:50:51PM +0100, Lupe Christoph wrote: > when I mean bind mounts. No, they are just an aliasing mechanism. Nope, they're not: ghost:/fs# mkdir testro ghost:/fs# mount -o bind,ro /tmp/ /fs/testro/ ghost:/fs# touch testro/q touch: cannot touch `testro/q': Read-only file syst

Re: Secure rsync setup, bind-mount ro

2006-12-18 Thread Lupe Christoph
On Monday, 2006-12-18 at 13:48:54 +0100, Dariush Pietrzak wrote: > > filesystems into the chroot you want to rsync. Since Linux does not > > support read-only loopback mounts, this leaves them open not only for > > reading but also for writing... > It does support read-only bind mounts though. So

Re: Secure rsync setup, bind-mount ro

2006-12-18 Thread Dariush Pietrzak
> filesystems into the chroot you want to rsync. Since Linux does not > support read-only loopback mounts, this leaves them open not only for > reading but also for writing... It does support read-only bind mounts though. -- Dariush Pietrzak, Key fingerprint = 40D0 9FFB 9939 7320 8294 05E0 BCC7

Re: Secure rsync setup

2006-12-18 Thread Lupe Christoph
On Monday, 2006-12-18 at 09:04:47 +0100, Frédéric VANNIÈRE wrote: > You should look at scponly, it's a shell which only allow scp, sftp > and rsync in > a very restricted chroot. > It works well, I'm using it for the backup of more 100 servers and > workstations. If you want to use scponlyc (

Re: Secure rsync setup

2006-12-18 Thread Frédéric VANNIÈRE
Hello, Le 17 déc. 06 à 17:20, Thorsten Schmidt a écrit : I'm thinking of using rsync for backup purposes. Sadly, the server (alpha) hosting the files I'd like to backup does not allow ssh or rsync connections - but I may execute rsync as a cron job or cgi-script. You should look at scpon

Re: Secure rsync setup

2006-12-17 Thread Izak Burger
On 12/17/06, Thorsten Schmidt <[EMAIL PROTECTED]> wrote: However, this requires alpha having a ssh-key. Furthermore I'm not in charge with alpha's security, thus I've to make sure, that a attacker, who gained access to alpha's ssh-key is not able to compromis beta (well, he might be able to delet

Re: Secure rsync setup

2006-12-17 Thread Evgeni Golov
On Sun, 17 Dec 2006 17:20:33 +0100 Thorsten Schmidt wrote: > However, this requires alpha having a ssh-key. Furthermore I'm not in > charge with alpha's security, thus I've to make sure, that a > attacker, who gained access to alpha's ssh-key is not able to > compromis beta (well, he might be able

Secure rsync setup

2006-12-17 Thread Thorsten Schmidt
Hello, I'm thinking of using rsync for backup purposes. Sadly, the server (alpha) hosting the files I'd like to backup does not allow ssh or rsync connections - but I may execute rsync as a cron job or cgi-script. But I run a server (beta - debian sarge), that may serve as the rsync server, the