7 ms·

Secure your rsync shares

82 points by stevekemp 13y ago

uslic001 13y ago
What is best way to secure rsync shares?
- SEJeff 13y ago
  Don't run rsync in daemon mode, only use it over ssh. Then there is no problem
  - RexRollman 13y ago
    Are rsync passwords normally plaintext is not over ssh?
- stevekemp 13y ago
  Either firewall the service, via iptables, or the ACL system that rsync supports natively: [foo] path = /srv/foo hosts allow 1.2.3.4, 10.20.30.0/24 In addition to that you can use passwords with rsync, or avoid exposing it directly and use ssh as a transport - secured with keys.
  - epoxyhockey 13y ago
    Using ssh as a transport has been my solution and it has been working very well. The sample command to do this is listed under the Troubleshooting section of this page: http://troy.jdmz.net/rsync/index.html http://troy.jdmz.net/rsync/index.html
gketuma 13y ago
I recently bought a lenovo ix2 NAS and was having some issues setting up rsync. Decided to go to their forums and found out that they turn on rsync by default and unsecure. So if you have this device connected to your network with default settings (which I presume many people will do), anyone on the internet can see your backups. Here is the comment from one person who made the discovery and according to him, he can scan and see peoples backups. http://forums.lenovo.com/t5/Iomega-Network-Storage/Security-Vulnerability-in-Lenovo-IX2-DL/m-p/1430085/highlight/true#M1618 http://forums.lenovo.com/t5/Iomega-Network-Storage/Security-...
- stevekemp 13y ago
  That's pretty bad, thanks for highlighting it. I could certainly see patterns in the things that were exposed. A lot of hosts exposed either: * A single share called "squid". * A pair of shares called "sql" & "www". That made me think of a control-panel of some kind.
- cortesoft 13y ago
  It would be behind a NAT for most people, though, right? Not saying that makes it ok, but at least a LITTLE less bad?
api 13y ago
Google searches for things like "inurl:PAYROLL.XLS" are always good for a hoot.
- UnoriginalGuy 13y ago
  Many of the top results are organisations which are legally required to publish their payroll (public universities, government agencies, and so on). So it isn't quite as bad as it might immediately appear...
__david__ 13y ago
Part of me thinks the best way to bring attention to this is to make your search engine and publish it. I don't see how this exposes liability for you—is Google liable when people leave their printer's/router's/fax's/whatever's web configuration interfaces on the public internet with no password? I don't believe they are, and I've seen a number of Google searches in the past on the Hacker News front page linking to pages and pages of them. However, like Google, you probably want to have a quick way for people to remove their site from the index once they've discovered and secured it. I, for one, would love to see a search engine of public rsync servers.
- stevekemp 13y ago
  You may be on to something; I'm just wary that actually downloading from an unsecured share would be "unauthorized access", and there have been too many cases where linking to torrents is equivalent to performing copyright infringement yourself. (I do own the rsync.io domain, so I have the perfect place to host it ..)
  - valarauca1 13y ago
    You have good reason to be afraid too. Remember the Weev case (like him or not) set things in motion. What would likely be best is contacting the owners (of possible). Have a 90 day period where you aren't listed but alerted privately. Then if noncompliance is maintained you to public.
    - stevekemp 13y ago
      Too often though it is hard to determine who to contact - e.g. you have a random IP, you look it up in whois and you find it belongs to a cable-provider. You can't map to that to an individual, unless you mail "abuse@isp" and hope they pass along the message. The alternative is to download all the private data, looking for email addresses and hoping for the best - i.e. They don't send a mail to "abuse@fbi.gov" about a hacker stealing their data and similar.
- rlpb 13y ago
mpchlets 13y ago
Oh it's people like you that ruin security through obscurity :P
jonalmeida 13y ago
Consider writing a post on how one can go about different ways to secure their rsync shares. I'd like to set one up, but I know close to nothing of how it works.
- stevekemp 13y ago
  Please do see the comment later down, about the "hosts allow" setting for the rsync-daemon. But in short you either need to restricted access by IP, configure a password, or disable the daemon and run rsync via SSH which avoids the problem entirely.
ars 13y ago
When installing a new machine one of the first things you should do is run netstat -tnlp | grep -v 127.0.0 | grep -v ::1: Then uninstall or reconfigure anything that is listening remotely.
- dsr_ 13y ago
  The problem is rarely at installation time. The problem is three years later, when you know that you've got rsync because it's so useful, but you don't remember that you left rsyncd running. Internal and external nmap sweeps: always a good idea* *If you don't own the network, get permission first.
  - jimktrains2 13y ago
    If you have system monitoring tools, then you could make on of the things it monitors a script that does netstat -plan | grep -v 127.0.0.1 | grep -v ::1 | grep -v ssh | grep -v <anything you know should be running> | wc -l
    - ars 13y ago
      Don't use -a though :) Use -t to avoid listing local sockets. So -pltn not -plan
- Florin_Andrei 13y ago
  It helps a lot if you just do a minimal install, and add components only on a need-to basis.
  - ars 13y ago
    Sometimes recommends will include things you don't actually need. Like rcpbind and nfs. So you still need to check after the install.
- sneak 13y ago
  I've always been a fan of lsof -n | grep LISTEN
UnoriginalGuy 13y ago
What is interesting is that the rsync daemon is not something typically enabled by default, you have to go in and manually turn it on, and if you don't alter the configuration to add users and passwords, it simply won't allow login at all. So someone has gone out of their way to set up insecure rsync daemons. I wonder if all of these open rsync daemons is due to a poorly configured appliances like a NAS or some other "turn-key" vendor supplied kit. But even then it is a strange thing to enable insecurely...
- stevekemp 13y ago
  One of the comments below did mention an insecure-by-default NAS: https://news.ycombinator.com/item?id=7232518 https://news.ycombinator.com/item?id=7232518
- RexRollman 13y ago
  Interesting. I knew it needed to be turned on but didn't realize that you needed to add users. So Rsync doesn't just use the default login info, the way SSH does?

82 points by stevekemp 13y ago

uslic001 13y ago

What is best way to secure rsync shares?

SEJeff 13y ago
Don't run rsync in daemon mode, only use it over ssh. Then there is no problem
- RexRollman 13y ago
  Are rsync passwords normally plaintext is not over ssh?
stevekemp 13y ago
Either firewall the service, via iptables, or the ACL system that rsync supports natively: [foo] path = /srv/foo hosts allow 1.2.3.4, 10.20.30.0/24 In addition to that you can use passwords with rsync, or avoid exposing it directly and use ssh as a transport - secured with keys.
- epoxyhockey 13y ago
  Using ssh as a transport has been my solution and it has been working very well. The sample command to do this is listed under the Troubleshooting section of this page: http://troy.jdmz.net/rsync/index.html http://troy.jdmz.net/rsync/index.html

gketuma 13y ago

I recently bought a lenovo ix2 NAS and was having some issues setting up rsync. Decided to go to their forums and found out that they turn on rsync by default and unsecure. So if you have this device connected to your network with default settings (which I presume many people will do), anyone on the internet can see your backups. Here is the comment from one person who made the discovery and according to him, he can scan and see peoples backups. http://forums.lenovo.com/t5/Iomega-Network-Storage/Security-Vulnerability-in-Lenovo-IX2-DL/m-p/1430085/highlight/true#M1618 http://forums.lenovo.com/t5/Iomega-Network-Storage/Security-...

stevekemp 13y ago
That's pretty bad, thanks for highlighting it. I could certainly see patterns in the things that were exposed. A lot of hosts exposed either: * A single share called "squid". * A pair of shares called "sql" & "www". That made me think of a control-panel of some kind.
cortesoft 13y ago
It would be behind a NAT for most people, though, right? Not saying that makes it ok, but at least a LITTLE less bad?

api 13y ago

Google searches for things like "inurl:PAYROLL.XLS" are always good for a hoot.

UnoriginalGuy 13y ago
Many of the top results are organisations which are legally required to publish their payroll (public universities, government agencies, and so on). So it isn't quite as bad as it might immediately appear...

__david__ 13y ago

Part of me thinks the best way to bring attention to this is to make your search engine and publish it. I don't see how this exposes liability for you—is Google liable when people leave their printer's/router's/fax's/whatever's web configuration interfaces on the public internet with no password? I don't believe they are, and I've seen a number of Google searches in the past on the Hacker News front page linking to pages and pages of them. However, like Google, you probably want to have a quick way for people to remove their site from the index once they've discovered and secured it. I, for one, would love to see a search engine of public rsync servers.

stevekemp 13y ago
You may be on to something; I'm just wary that actually downloading from an unsecured share would be "unauthorized access", and there have been too many cases where linking to torrents is equivalent to performing copyright infringement yourself. (I do own the rsync.io domain, so I have the perfect place to host it ..)
- valarauca1 13y ago
  You have good reason to be afraid too. Remember the Weev case (like him or not) set things in motion. What would likely be best is contacting the owners (of possible). Have a 90 day period where you aren't listed but alerted privately. Then if noncompliance is maintained you to public.
  - stevekemp 13y ago
    Too often though it is hard to determine who to contact - e.g. you have a random IP, you look it up in whois and you find it belongs to a cable-provider. You can't map to that to an individual, unless you mail "abuse@isp" and hope they pass along the message. The alternative is to download all the private data, looking for email addresses and hoping for the best - i.e. They don't send a mail to "abuse@fbi.gov" about a hacker stealing their data and similar.
rlpb 13y ago

mpchlets 13y ago

Oh it's people like you that ruin security through obscurity :P

jonalmeida 13y ago

Consider writing a post on how one can go about different ways to secure their rsync shares. I'd like to set one up, but I know close to nothing of how it works.

stevekemp 13y ago
Please do see the comment later down, about the "hosts allow" setting for the rsync-daemon. But in short you either need to restricted access by IP, configure a password, or disable the daemon and run rsync via SSH which avoids the problem entirely.

ars 13y ago

When installing a new machine one of the first things you should do is run netstat -tnlp | grep -v 127.0.0 | grep -v ::1: Then uninstall or reconfigure anything that is listening remotely.

dsr_ 13y ago
The problem is rarely at installation time. The problem is three years later, when you know that you've got rsync because it's so useful, but you don't remember that you left rsyncd running. Internal and external nmap sweeps: always a good idea* *If you don't own the network, get permission first.
- jimktrains2 13y ago
  If you have system monitoring tools, then you could make on of the things it monitors a script that does netstat -plan | grep -v 127.0.0.1 | grep -v ::1 | grep -v ssh | grep -v <anything you know should be running> | wc -l
  - ars 13y ago
    Don't use -a though :) Use -t to avoid listing local sockets. So -pltn not -plan
Florin_Andrei 13y ago
It helps a lot if you just do a minimal install, and add components only on a need-to basis.
- ars 13y ago
  Sometimes recommends will include things you don't actually need. Like rcpbind and nfs. So you still need to check after the install.
sneak 13y ago
I've always been a fan of lsof -n | grep LISTEN

UnoriginalGuy 13y ago

What is interesting is that the rsync daemon is not something typically enabled by default, you have to go in and manually turn it on, and if you don't alter the configuration to add users and passwords, it simply won't allow login at all. So someone has gone out of their way to set up insecure rsync daemons. I wonder if all of these open rsync daemons is due to a poorly configured appliances like a NAS or some other "turn-key" vendor supplied kit. But even then it is a strange thing to enable insecurely...

stevekemp 13y ago
One of the comments below did mention an insecure-by-default NAS: https://news.ycombinator.com/item?id=7232518 https://news.ycombinator.com/item?id=7232518
RexRollman 13y ago
Interesting. I knew it needed to be turned on but didn't realize that you needed to add users. So Rsync doesn't just use the default login info, the way SSH does?