Re: RSSH Rsync issues.

[Russ A. <rr...@st...>]

Scott Ehas <sco...@gi...> writes:

> I am unable to find any documentation on the Rsync functions for RSSH.
> Every time I try to Rsync with the RSSH I get a "insecure -e option now
> allowed".  I was wondering if you can spot the problem and review the
> output below.  Please let me know if you can provide any help.

You need patches in order to work with the latest rsync.  They reused the
-e option in a very unfortunate way to specify protocol information, and
it's quite tricky to ensure that the running command is still secure.

Debian (and I believe some others) are using the attached, which is
against 2.3.4.  (I would point you to the Debian patch tracker, but it's
down at the moment; the link at:

    http://patch-tracker.debian.org/package/rssh/2.3.3-6

has the patch set against 2.3.3, which includes the security fix in 2.3.4,
but that's not as clean as the patches based on 2.3.4 directly.)

-- 
Russ Allbery (rr...@st...)             <http://www.eyrie.org/~eagle/>