3 ms·

rsync has specific running modes for the super-user. It also pumps arbitrary data from the network onto your file-system. openrsync is about 10 000 lines of C c

by tptacek 5mo ago

rsync has specific running modes for the super-user. It also pumps arbitrary data from the network onto your file-system. openrsync is about 10 000 lines of C code: do you trust me not to make mistakes? No, but that's why almost nobody runs it outside of strict trust boundaries. This security section would make more sense if rsync was like curl, which routinely deals with hostile counterparties. If the other side of your rsync is hostile, you probably have bigger problems! (I'm not an rpki person so I don't know if there's some part of that problem domain that changes this equation. I'm not dunking on the project, just saying this snagged me in the README).

cperciva 5mo ago
No, but that's why almost nobody runs it outside of strict trust boundaries. This security section would make more sense if rsync was like curl, which routinely deals with hostile counterparties. If the other side of your rsync is hostile, you probably have bigger problems! I disagree. While rsync is most often used to transfer data between "friendly" systems, it's inherently crossing a security boundary. It's important to make sure that an attacker can't leverage it to transform the breach of one system into the breach of multiple systems.
- eikenberry 5mo ago
  It is almost universally hooked up using ssh tunneling so ssh takes care of the security boundary and ssh is well trusted.
  - cperciva 5mo ago
    That solves the traffic tampering problem, but not the "malicious peer" problem. You want to be able to sync files without accidentally sharing root privileges.
delusional 5mo ago
> almost nobody runs it outside of strict trust boundaries. I guess you can define "strict" however you want, but from what I saw ~10 years ago, most linux distros handled mirroring with rsync. That's a lot of usage in a pretty core part of the foundational open source ecosystem.
- akerl_ 5mo ago
  Many distros use rsync for that but also support unencrypted HTTP. They’re layering on checksums and signing such that they mostly don’t think about the trustworthiness of mirrors or the networks between them.
- tptacek 5mo ago
  OK, I agree, that's bad.
NewJazz 5mo ago
With rpki, you sync from sources you may not trust AIUI.

by tptacek 5mo ago

cperciva 5mo ago

No, but that's why almost nobody runs it outside of strict trust boundaries. This security section would make more sense if rsync was like curl, which routinely deals with hostile counterparties. If the other side of your rsync is hostile, you probably have bigger problems! I disagree. While rsync is most often used to transfer data between "friendly" systems, it's inherently crossing a security boundary. It's important to make sure that an attacker can't leverage it to transform the breach of one system into the breach of multiple systems.

eikenberry 5mo ago
It is almost universally hooked up using ssh tunneling so ssh takes care of the security boundary and ssh is well trusted.
- cperciva 5mo ago
  That solves the traffic tampering problem, but not the "malicious peer" problem. You want to be able to sync files without accidentally sharing root privileges.

delusional 5mo ago

> almost nobody runs it outside of strict trust boundaries. I guess you can define "strict" however you want, but from what I saw ~10 years ago, most linux distros handled mirroring with rsync. That's a lot of usage in a pretty core part of the foundational open source ecosystem.

akerl_ 5mo ago
Many distros use rsync for that but also support unencrypted HTTP. They’re layering on checksums and signing such that they mostly don’t think about the trustworthiness of mirrors or the networks between them.
tptacek 5mo ago
OK, I agree, that's bad.

NewJazz 5mo ago

With rpki, you sync from sources you may not trust AIUI.