rssh security update breaks rsync via Synology's "hyper backup"

From	Roman Medina-Heigl Hernandez <roman@rs-labs.com>
Newsgroups	linux.debian.security
Subject	rssh security update breaks rsync via Synology's "hyper backup"
Date	2019-02-14 18:20 +0100
Message-ID	<xrsQ2-YV-5@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi security-fellows,

I applied recent rssh security updates to Debian 8 (jessie) and I
noticed that it breaks Synology's "Hyper backup" tool (with rsync method).

The relevant log lines at my Debian server:

Feb 10 03:28:21 roman rssh[19985]: cmd 'rsync' approved
Feb 10 03:28:21 roman rssh[19985]: insecure rsync options in rsync
command line!
Feb 10 03:28:21 roman rssh[19985]: user synology attempted to execute
forbidden commands
Feb 10 03:28:21 roman rssh[19985]: command: rsync --server --daemon .

Is it really unsafe to issue a "rsync --server --daemon ." command so it
deserves to be blocked?`


PS: OS info:

root@roman:~# cat /etc/debian_version
8.11
root@roman:~# dpkg -l rssh           
Deseado=desconocido(U)/Instalar/eliminaR/Purgar/retener(H)
|
Estado=No/Inst/ficheros-Conf/desempaqUetado/medio-conF/medio-inst(H)/espera-disparo(W)/pendienTe-disparo
|/ Err?=(ninguno)/requiere-Reinst (Estado,Err: mayúsc.=malo)
||/ Nombre                                Versión                
Arquitectura            Descripción
+++-=====================================-=======================-=======================-================================================================================
ii  rssh                                  2.3.4-4+deb8u2         
amd64                   Restricted shell allowing scp, sftp, cvs, svn,
rsync or rdist

PS2: I'm not suscribed to LTS-list, but I guess the problem may be both
in stable and oldstable versions.

Cheers,

-Román

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-14 18:20 +0100
  Re: rssh security update breaks rsync via Synology's "hyper backup" Holger Levsen <holger@layer-acht.org> - 2019-02-14 18:40 +0100
    Re: rssh security update breaks rsync via Synology's "hyper backup" Chris Lamb <lamby@debian.org> - 2019-02-14 18:50 +0100
      Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-14 19:00 +0100
        Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-14 19:10 +0100
          Re: rssh security update breaks rsync via Synology's "hyper backup" Antoine Beaupré <anarcat@orangeseeds.org> - 2019-02-14 19:50 +0100
            Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-18 18:30 +0100
              Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-18 19:40 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-19 04:20 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-19 16:10 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-19 17:50 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-20 19:20 +0100
              Re: rssh security update breaks rsync via Synology's "hyper backup" Antoine Beaupré <anarcat@orangeseeds.org> - 2019-02-18 22:10 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Chris Lamb <lamby@debian.org> - 2019-02-18 22:30 +0100
              Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <eagle@eyrie.org> - 2019-02-19 06:00 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Chris Lamb <lamby@debian.org> - 2019-02-19 09:20 +0100

csiph-web