>I'm thinking of how to backup an entire server ("server A") to a >remote area ("server B") using rsync. > >My initial thought was to have a shell account on server B, then have a >cronjob running as root on server A that uses rsync to send all the files >over to the shell account on server B. > >Then I thought that this is not reliable against hackers, because if >someone hacked the machine, he can find the cron job, get the password to >the shell account on server B, and delete that backup. > >So, it sounds like server B should be the one with the cron job, >synchronizing with server A. > >My question is: How can I make server A give READ-ONLY rsync access of the >entire disk to server B?Something similar the following in the /etc/rsyncd.conf file in the server A might work(?) - just put a "read only = yes" in the config. (plus retricting the hosts allow) I guess the path would be / Would this work? Lachlan. motd file = /etc/motd max connections = 5 syslog facility = local3 [mirrorserver] comment = mirror server path = / read only = yes list = yes uid = nobody gid = nobody hosts allow = *.blah.com *.blogs.com auth users = rsyncuser secrets file = /etc/blahrsyncd.secrets ----------------------- Lachlan M. D. Cranswick Collaborative Computational Project No 14 (CCP14) for Single Crystal and Powder Diffraction Birkbeck University of London and Daresbury Laboratory Postal Address: CCP14 - School of Crystallography, Birkbeck College, Malet Street, Bloomsbury, WC1E 7HX, London, UK Tel: (+44) 020 7631 6849 Fax: (+44) 020 7631 6803 E-mail: l.m.d.cranswick@dl.ac.uk WWW: http://www.ccp14.ac.uk/
On Tue, 18 Dec 2001, Lachlan Cranswick wrote:> >My question is: How can I make server A give READ-ONLY rsync access of the > >entire disk to server B? > > Something similar the following in the /etc/rsyncd.conf file in the > server A might work(?) - just put a "read only = yes" in the config. > (plus retricting the hosts allow) I guess the path would be / > > path = / > read only = yes > uid = nobody > gid = nobodyWouldn't I need to put "uid = root" in order to give access to the entire file system (but read only)? Is this safe?
readonly full disk.
rsync yourhost::rootmodule/etc/shadow .
satan -f ./shadow
telnet yourhost
login as user
su -
f*** you over.
what, no telnet, only ssh?
grab an identity file and ssh in.
yes, it's bad... at least, exclude secure areas.
Tim Conway
tim.conway@philips.com
303.682.4917
Philips Semiconductor - Longmont TC
1880 Industrial Circle, Suite D
Longmont, CO 80501
Available via SameTime Connect within Philips, n9hmg on AIM
perl -e 'print pack(nnnnnnnnnnnn,
19061,29556,8289,28271,29800,25970,8304,25970,27680,26721,25451,25970),
".\n" '
"There are some who call me.... Tim?"
Philip Mak <pmak@animeglobe.com>
Sent by: rsync-admin@lists.samba.org
12/18/2001 11:51 AM
To: Lachlan Cranswick <l.m.d.cranswick@dl.ac.uk>
cc: <rsync@lists.samba.org>
(bcc: Tim Conway/LMT/SC/PHILIPS)
Subject: Re: RSYNC: Backup Solution thoughts...
Classification:
On Tue, 18 Dec 2001, Lachlan Cranswick wrote:
> >My question is: How can I make server A give READ-ONLY rsync access of
the> >entire disk to server B?
>
> Something similar the following in the /etc/rsyncd.conf file in the
> server A might work(?) - just put a "read only = yes" in the
config.
> (plus retricting the hosts allow) I guess the path would be /
>
> path = /
> read only = yes
> uid = nobody
> gid = nobody
Wouldn't I need to put "uid = root" in order to give access to the
entire
file system (but read only)? Is this safe?
First: yes, wide open.
Second: Sure, if your network is secure. I initially didn't understand
that you were going to limit access. Anyway, trusted host access is a
vulnerability. You know your system and situation.
Tim Conway
tim.conway@philips.com
303.682.4917
Philips Semiconductor - Longmont TC
1880 Industrial Circle, Suite D
Longmont, CO 80501
Available via SameTime Connect within Philips, n9hmg on AIM
perl -e 'print pack(nnnnnnnnnnnn,
19061,29556,8289,28271,29800,25970,8304,25970,27680,26721,25451,25970),
".\n" '
"There are some who call me.... Tim?"
Philip Mak <pmak@animeglobe.com>
12/18/2001 04:50 PM
To: Tim Conway/LMT/SC/PHILIPS@AMEC
cc: <rsync@lists.samba.org>
Subject: Re: RSYNC: Backup Solution thoughts...
Classification:
If I understand correctly, you're saying that if someone manages to gain
access to my rsync server, they can read my password files and private
keys, right?
How would they accomplish gaining access to my rsync server, though? Only
my backup server would be authorized to connect to it...
I think I *do* want to back up /etc/shadow actually, because this is a
full system backup that's meant to be able to be used to restore the
system in case of hard drive failure. If I didn't include /etc/shadow,
then everyone would lose their passwords.
On Tue, 18 Dec 2001 tim.conway@philips.com wrote:
> readonly full disk.
> rsync yourhost::rootmodule/etc/shadow .
> satan -f ./shadow
> telnet yourhost
> login as user
> su -
> f*** you over.
>
> what, no telnet, only ssh?
> grab an identity file and ssh in.
>
> yes, it's bad... at least, exclude secure areas.