Thread: RSSH Rsync issues.
Brought to you by:
xystrus
From: Scott E. <sco...@gi...> - 2013-08-15 16:32:49
|
Hello, I am unable to find any documentation on the Rsync functions for RSSH. Every time I try to Rsync with the RSSH I get a "insecure -e option now allowed". I was wondering if you can spot the problem and review the output below. Please let me know if you can provide any help. 1. scott /home/scott rsync -Pav "ssh" scott@X.X.X.X:/home/scott 2. The authenticity of host 'X.X.X.X (X.X.X.X)' can't be established. 3. RSA key fingerprint is . 4. Are you sure you want to continue connecting (yes/no)? yes 5. Warning: Permanently added 'X.X.X.X' (RSA) to the list of known hosts. 6. scott@X.X.X.X's password: 7. 8. insecure -e option not allowed. 9. This account is restricted by rssh. 10. Allowed commands: scp sftp rdist rsync 11. 12. If you believe this is in error, please contact your system administrator. 13. 14. rsync: connection unexpectedly closed (0 bytes received so far) [sender] 15. rsync error: error in rsync protocol data stream (code 12) at io.c(605) [sender=3.0.9] 16. 17. --------------------------------------------------------------------------------------- 18. /var/log/messages -- 19. 20. Aug 15 10:50:42 FTPBeast-Dev rssh[2081]: allowing scp to all users 21. Aug 15 10:50:42 FTPBeast-Dev rssh[2081]: allowing sftp to all users 22. Aug 15 10:50:42 FTPBeast-Dev rssh[2081]: allowing rdist to all users 23. Aug 15 10:50:42 FTPBeast-Dev rssh[2081]: allowing rsync to all users 24. Aug 15 10:50:42 FTPBeast-Dev rssh[2081]: setting umask to 022 25. Aug 15 10:50:42 FTPBeast-Dev rssh[2081]: insecure -e option in rdist command line! 26. Aug 15 10:50:42 FTPBeast-Dev rssh[2081]: user scott attempted to execute forbidden commands 27. Aug 15 10:50:42 FTPBeast-Dev rssh[2081]: command: rsync --server -vlogDtpre.iLsf --partial . /home/scott 28. 29. ---------------------------------------------------------------------------------------- 30. /etc/rssh.conf 31. logfacility = LOG_USER 32. allowscp 33. allowsftp 34. allowrdist 35. allowrsync |
From: Russ A. <rr...@st...> - 2013-08-15 18:45:50
Attachments:
rsync-protocol.diff
|
Scott Ehas <sco...@gi...> writes: > I am unable to find any documentation on the Rsync functions for RSSH. > Every time I try to Rsync with the RSSH I get a "insecure -e option now > allowed". I was wondering if you can spot the problem and review the > output below. Please let me know if you can provide any help. You need patches in order to work with the latest rsync. They reused the -e option in a very unfortunate way to specify protocol information, and it's quite tricky to ensure that the running command is still secure. Debian (and I believe some others) are using the attached, which is against 2.3.4. (I would point you to the Debian patch tracker, but it's down at the moment; the link at: http://patch-tracker.debian.org/package/rssh/2.3.3-6 has the patch set against 2.3.3, which includes the security fix in 2.3.4, but that's not as clean as the patches based on 2.3.4 directly.) -- Russ Allbery (rr...@st...) <http://www.eyrie.org/~eagle/> |