Re: rssh security update breaks rsync via Synology's "hyper backup"

From	Roman Medina-Heigl Hernandez <roman@rs-labs.com>
Newsgroups	linux.debian.security
Subject	Re: rssh security update breaks rsync via Synology's "hyper backup"
Date	2019-02-20 19:20 +0100
Message-ID	<xtEDo-4vl-5@gated-at.bofh.it> (permalink)
References	(6 earlier) <xsUTU-2OO-23@gated-at.bofh.it> <xsVZD-3p9-1@gated-at.bofh.it> <xt46R-8mB-5@gated-at.bofh.it> <xtfbY-6qu-1@gated-at.bofh.it> <xtgKK-7ai-17@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

El 19/02/2019 a las 17:44, Russ Allbery escribió:

> Roman Medina-Heigl Hernandez <roman@rs-labs.com> writes:
>
> So you cannot overwrite /home/synology/rsyncd.conf.
> Can the client just do:
>
>     rsync rsyncd.conf <your-host>:./
>
You're right, I was wrong. It's game over :)

> I think to make this safe the home directory has to not be owned by the
> rssh user and not be writable by it.  That might be safe as long as the
> current working directory of rsync is always the home directory.
> (In your particular case, as mentioned in the previous message, I'm pretty
> sure command="rsync --server -daemon ." in the authorized_keys file does
> what you want since you don't need to allow other arbitrary rsync
> commands.)

Thanks Russ and all for your help.

Cheers,

-Román

Thread

rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-14 18:20 +0100
  Re: rssh security update breaks rsync via Synology's "hyper backup" Holger Levsen <holger@layer-acht.org> - 2019-02-14 18:40 +0100
    Re: rssh security update breaks rsync via Synology's "hyper backup" Chris Lamb <lamby@debian.org> - 2019-02-14 18:50 +0100
      Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-14 19:00 +0100
        Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-14 19:10 +0100
          Re: rssh security update breaks rsync via Synology's "hyper backup" Antoine Beaupré <anarcat@orangeseeds.org> - 2019-02-14 19:50 +0100
            Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-18 18:30 +0100
              Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-18 19:40 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-19 04:20 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-19 16:10 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-19 17:50 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-20 19:20 +0100
              Re: rssh security update breaks rsync via Synology's "hyper backup" Antoine Beaupré <anarcat@orangeseeds.org> - 2019-02-18 22:10 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Chris Lamb <lamby@debian.org> - 2019-02-18 22:30 +0100
              Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <eagle@eyrie.org> - 2019-02-19 06:00 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Chris Lamb <lamby@debian.org> - 2019-02-19 09:20 +0100

csiph-web