rssh

On Wed, Jun 29, 2011 at 02:17:37PM +0200, OBones wrote:
> First of all, thank you for rssh, it's very convenient when one, like 
> me, wants to restrict a user to rsync only.

You're welcome!

> I have a problem though: When using the latest versions of rsync
> where the protocol is 30 or above, rssh prevents it from working
> because rsync uses -e as an internal option.

Yes, and it's also the same command line option that rsync uses to
specify a different remote shell...  So it's either the version, or
it's something that could potentially affect the security of your
system.  it's atrocious interface design IMO, and I won't support it.  

> There is a patch available here:
[...]
> Are there any plans to include such a fix in later versions?

Not ever, no.  I would much rather remove rsync support entirely.
However some of the distros have included rssh and added the patch.
You might have luck with that.  

> Right now I have to add  --protocol=29 in the argument list for
> rsync but that means I cannot use the latest evolutions of the
> protocol unless I patch an compile the application myself. And I
> would have to remember to apply the patch for every new version

I wouldn't worry about that very much.  It's unlikely that there will
ever be another version of RSSH.  The only updates are for security
bugs, and there hasn't been one found in about a year, and that was
fairly trivial.  The last release before that was in 2006.

-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

On Thu, Jun 30, 2011 at 01:21:51PM +0200, Aurelin wrote:
> You can find the download here:
> http://aurelin.net/downloads.htm
> 
> Uhm, I versioned it as rssh-2.3.4-2 (2.3.4 for sudo addition, -1 for
> the rsync-patch, -2 for some corrections and changes), but I'm not
> sure whether this is okay, so if not, please tell me.
> I'm a noob, concerning versioning and such.. ;)

What you've done effectively is forked the code.  That's perfectly OK,
but you probably should give it a different name to indicate that it is
no longer the main line code.  Or at least clearly document somewhere
in the software distribution that you've made changes that are not in
the original code line.

As for the changes themselves, I'm inclined to think that it's a bad
idea, generally.  It only makes sense in the context of restricting
sudo (allowing full sudo completely defeats the purpose of rssh).  In
the general case, configuring restricted sudo access is quite
difficult to get right... so many things allow you to get a shell, not
always in obvious ways.  A bug in sudo or any unexpected shell access
results in a complete system compromise, *even if you use a chroot
jail*.  I would personally never ever give sudo access to any user
whom I did not completely trust to have full root access to my
machine.  YMMV. :)

-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D