rsync - Mar 2005 - Anonymous rsync + chroot + LDAP

[* I'm not on the mailing list, so please copy me on any replies; thanks. *]

I was running an anonymous rsync server with chroot (i.e. not overriding
the default) on a Fedora Core 2 system using flat files for
authentication, which I recently upgraded to Fedora Core 3 using LDAP for
authentication, and found that the anonymous rsync server wouldn't start
up. The problem when away if I turned off chroot, or if I put a copy of
libnss_ldap.so.2 into ${path}/lib/libnss_ldap.so.2. Is that the expected
behavior, or should a chrooted anon-rsync work on an LDAP-using system out
of the box?

                                      -Josh (jbs@cacr.caltech.edu)

On Tue, Mar 01, 2005 at 03:53:45PM -0800, Josh Smith
wrote:
> The problem when away if I turned off chroot, or if I put a copy of
> libnss_ldap.so.2 into ${path}/lib/libnss_ldap.so.2.
Some folks have been reporting that an rsync daemon running on FC 2 (and
now FC 3) with chroot enabled dies when the password library functions
attempt to lookup the user information (though it might also be group
information on some systems -- I don't have enough details to be sure).
I don't know if LDAP was involved with the earlier incidents or not.
I'm assuming that the crash is occurring in the library routines
themselves, but I haven't yet see a backtrace from a core dump to know
for sure.

What should happen in rsync is that the call to lookup the name of a UID
should simply fail, and rsync would proceed as though --numeric-ids had
been specified.  This is what happens for my setups, but they just use
the old-fashioned /etc/passwd /etc/group lookups.

You already discovered two ways to work around the problem -- turning
off chroot and putting the libraries for the username lookup into the
chroot environment.  One other one is to have the clients specify
--numeric-ids on the command-line.

The most useful thing would be for someone to get a core dump of the
crash, list the backtrace, and discover if this is a bug in the
libraries.  If (as I suspect) it is, a bug report to the affected
library's author is in order.

..wayne..