Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5544

Re: rssh security update breaks rsync via Synology's "hyper backup"

Show all headers | View raw

Added Russ (rssh maintainer).

I cannot probe it but I guess chances are high that the issue is present
both in stable and oldstable (I cannot find a good reason to filter
different commands: solution should be the same or very similar) so I'm
still keeping debian-security in the loop.


PS: Thx Holger & Chris.

Cheers,

-Román


El 14/02/2019 a las 18:47, Chris Lamb escribió:
> [debian-security@lists.debian.org → Bcc]
>
> Holger Levsen wrote:
>
>>> I applied recent rssh security updates to Debian 8 (jessie) and I
>>> noticed that it breaks Synology's "Hyper backup" tool (with rsync method).
>>>
>>> Feb 10 03:28:21 roman rssh[19985]: cmd 'rsync' approved
>>> Feb 10 03:28:21 roman rssh[19985]: insecure rsync options in rsync
>>> command line!
>>> Feb 10 03:28:21 roman rssh[19985]: user synology attempted to execute
>>> forbidden commands
>>> Feb 10 03:28:21 roman rssh[19985]: command: rsync --server --daemon .
>>>
>>> Is it really unsafe to issue a "rsync --server --daemon ." command so it
>>> deserves to be blocked?`
> FYI this is the patch in question:
>
> https://sources.debian.org/src/rssh/2.3.4-11/debian/patches/0007-Verify-rsync-command-options.patch/#L15-L20
>
>
> Regards,
>

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-14 18:20 +0100
  Re: rssh security update breaks rsync via Synology's "hyper backup" Holger Levsen <holger@layer-acht.org> - 2019-02-14 18:40 +0100
    Re: rssh security update breaks rsync via Synology's "hyper backup" Chris Lamb <lamby@debian.org> - 2019-02-14 18:50 +0100
      Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-14 19:00 +0100
        Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-14 19:10 +0100
          Re: rssh security update breaks rsync via Synology's "hyper backup" Antoine Beaupré <anarcat@orangeseeds.org> - 2019-02-14 19:50 +0100
            Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-18 18:30 +0100
              Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-18 19:40 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-19 04:20 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-19 16:10 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-19 17:50 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-20 19:20 +0100
              Re: rssh security update breaks rsync via Synology's "hyper backup" Antoine Beaupré <anarcat@orangeseeds.org> - 2019-02-18 22:10 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Chris Lamb <lamby@debian.org> - 2019-02-18 22:30 +0100
              Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <eagle@eyrie.org> - 2019-02-19 06:00 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Chris Lamb <lamby@debian.org> - 2019-02-19 09:20 +0100

csiph-web