Re: rssh security update breaks rsync via Synology's "hyper backup"

From	Russ Allbery <rra@debian.org>
Newsgroups	linux.debian.security
Subject	Re: rssh security update breaks rsync via Synology's "hyper backup"
Date	2019-02-19 17:50 +0100
Message-ID	<xtgKK-7ai-17@gated-at.bofh.it> (permalink)
References	(5 earlier) <xruf7-1Hx-1@gated-at.bofh.it> <xsUTU-2OO-23@gated-at.bofh.it> <xsVZD-3p9-1@gated-at.bofh.it> <xt46R-8mB-5@gated-at.bofh.it> <xtfbY-6qu-1@gated-at.bofh.it>
Organization	The Eyrie

Show all headers | View raw

Roman Medina-Heigl Hernandez <roman@rs-labs.com> writes:

> Well, in my case I had the following setting in rsyncd.conf:

> path = /backup/synology

> where path points to a different directory which is NOT $home nor
> doesn't permit to reach $home.

> So you cannot overwrite /home/synology/rsyncd.conf.

Can the client just do:

    rsync rsyncd.conf <your-host>:./

first?

I think to make this safe the home directory has to not be owned by the
rssh user and not be writable by it.  That might be safe as long as the
current working directory of rsync is always the home directory.

(In your particular case, as mentioned in the previous message, I'm pretty
sure command="rsync --server -daemon ." in the authorized_keys file does
what you want since you don't need to allow other arbitrary rsync
commands.)

-- 
Russ Allbery (rra@debian.org)               <http://www.eyrie.org/~eagle/>

Thread

rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-14 18:20 +0100
  Re: rssh security update breaks rsync via Synology's "hyper backup" Holger Levsen <holger@layer-acht.org> - 2019-02-14 18:40 +0100
    Re: rssh security update breaks rsync via Synology's "hyper backup" Chris Lamb <lamby@debian.org> - 2019-02-14 18:50 +0100
      Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-14 19:00 +0100
        Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-14 19:10 +0100
          Re: rssh security update breaks rsync via Synology's "hyper backup" Antoine Beaupré <anarcat@orangeseeds.org> - 2019-02-14 19:50 +0100
            Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-18 18:30 +0100
              Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-18 19:40 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-19 04:20 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-19 16:10 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <rra@debian.org> - 2019-02-19 17:50 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2019-02-20 19:20 +0100
              Re: rssh security update breaks rsync via Synology's "hyper backup" Antoine Beaupré <anarcat@orangeseeds.org> - 2019-02-18 22:10 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Chris Lamb <lamby@debian.org> - 2019-02-18 22:30 +0100
              Re: rssh security update breaks rsync via Synology's "hyper backup" Russ Allbery <eagle@eyrie.org> - 2019-02-19 06:00 +0100
                Re: rssh security update breaks rsync via Synology's "hyper backup" Chris Lamb <lamby@debian.org> - 2019-02-19 09:20 +0100

csiph-web