Re: Rsync security

2004-07-16 Thread Wayne Davison
On Fri, Jul 16, 2004 at 01:01:21PM -0400, Dan Pritts wrote: > I'd suggest changing the last sentence to something like > > This is the default when both the source and target are filesystems > (local or networked) mounted on the local machine. Yeah, that could be made clearer. I just checked

Re: Rsync security

2004-07-16 Thread Dan Pritts
late followup to this thread - i just had noted in the man page that this was unclear and found this thread waiting on the list for me when i came to catch up. -W, --whole-file With this option the incremental rsync algorithm is not used and the whole file is sen

Re: Rsync security

2004-06-16 Thread Chris Shoemaker
On Wed, Jun 16, 2004 at 02:37:25PM -0700, Wayne Davison wrote: > On Wed, Jun 16, 2004 at 12:30:04PM -0400, Chris Shoemaker wrote: > > Do any "rsync developers" care to confirm/deny? [...] I've used rsync > > over NFS with no problems. > > It has been said many times before that using network-mo

Re: Rsync security

2004-06-16 Thread Wayne Davison
On Wed, Jun 16, 2004 at 12:30:04PM -0400, Chris Shoemaker wrote: > Do any "rsync developers" care to confirm/deny? [...] I've used rsync > over NFS with no problems. It has been said many times before that using network-mounted disks is suboptimal because rsync is optimizing the data transfer,

Re: Rsync security

2004-06-16 Thread Chris Shoemaker
On Wed, Jun 16, 2004 at 04:34:46PM +0100, Andrew Smith-MAGAZINES wrote: > My personal preference was to mount a share from the file server on the client and > essentially do the sync all locally on the client but rsync doesn't seem to like > doing this very much (apparently this is advised agains

RE: Rsync security

2004-06-16 Thread Andrew Smith-MAGAZINES
My personal preference was to mount a share from the file server on the client and essentially do the sync all locally on the client but rsync doesn't seem to like doing this very much (apparently this is advised against), What doesn't rsync like? Do you mean something like a rsync between a lo

Re: Rsync security

2004-06-15 Thread Chris Shoemaker
On Tue, Jun 15, 2004 at 03:37:21PM +0100, ww m-pubsyssamba wrote: > Hello list, > > I have a requirement to script a sync from a server to a UNIX workstation (Mac > OS X) users desktop and profile related data at logon and > logoff. Rsync looks like it may be appropriate, but I am concerned

Re: Rsync security

2004-06-15 Thread Dan Pritts
> quite uncomfortable about using this across hundreds of workstations to provide the > sync functionality I'm looking for. Specifically my fear is if > someone gains administrative access to their workstation and can access the ssh > private key & ssh server key they will be able to access any >

Rsync security

2004-06-15 Thread ww m-pubsyssamba
Hello list, I have a requirement to script a sync from a server to a UNIX workstation (Mac OS X) users desktop and profile related data at logon and logoff. Rsync looks like it may be appropriate, but I am concerned about making a sufficiently secure connection between the server and the

Re: rsync security advisory

2003-12-04 Thread Paul Haas
On Thu, 4 Dec 2003, Paul Slootman wrote: > Date: Thu, 4 Dec 2003 11:34:44 +0100 > From: Paul Slootman <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: Re: rsync security advisory > > On Thu 04 Dec 2003, Martin Pool wrote: > > > > - rsync version 2.5.6 co

Re: rsync security advisory

2003-12-04 Thread Paul Slootman
On Thu 04 Dec 2003, Paul Haas wrote: > > On Thu 04 Dec 2003, Martin Pool wrote: > > > > > > - rsync version 2.5.6 contains a heap overflow vulnerability that can > > >be used to remotely run arbitrary code. > > > > Is this specific to 2.5.6, or are earlier versions also vulnerable? > > Importa

Re: [rsync-announce] rsync security advisory

2003-12-04 Thread Daemian Mack
[EMAIL PROTECTED] wrote: rsync 2.5.6 security advisory - December 4th 2003 Background -- The rsync team has received evidence that a vulnerability in rsync was recently used in combination with a Linux kernel vulnerability to compromise the security of a public

Re: rsync security advisory

2003-12-04 Thread Paul Slootman
On Thu 04 Dec 2003, Martin Pool wrote: > > - rsync version 2.5.6 contains a heap overflow vulnerability that can >be used to remotely run arbitrary code. Is this specific to 2.5.6, or are earlier versions also vulnerable? Important detail, as it makes the difference between needing to upgrad

[rsync-announce] rsync security advisory

2003-12-03 Thread rsync-announce
rsync 2.5.6 security advisory - December 4th 2003 Background -- The rsync team has received evidence that a vulnerability in rsync was recently used in combination with a Linux kernel vulnerability to compromise the security of a public rsync server. While

Re: rsync: Security

2000-11-14 Thread Bill Campbell
On Tue, Nov 14, 2000 at 10:26:08AM -, Liston Johnson wrote: >Hi > >Can anyone give me some examples of using rsync with ipchains in order to >stop someone from the outside using rsync to copy files/directories from a >server. Wouldn't it be easier to do this with tcp_wrappers? Bill -- INTERN