Restrict which IP addresses are allowed to connect to your rsync server, for example:.You can check by running systemd-analyze security rvice, which should result in an exposure level of “0.2 SAFE” as of systemd 249 (September 2021).įirst, configure your server flags by creating a systemd service override file: These files enables most of systemd’s security features. We provide a gokr-rsyncd.socket and rvice file for systemd. See also Per-IP rate limiting with iptables.consuming too many resources (connections, bandwidth, CPU, …). gokr-rsyncd does not guard against denial of service attacks, i.e.gokr-rsyncd is running without privileges, as user nobody, to limit the scope of what an attacker can do when exploiting a vulnerability.(On Linux only) The host file system is made read-only for gokr-rsyncd, to guard against accidental data exfiltration.In all environments, the default instructions will take care that: Supported environments and privilege dropping xattrs (including acls) was introduced in rsync protocol 30, so is currently not supported.Implementing support for more recent protocol versions would help here, as these include hash algorithm negotiation with more recent choices. The current bottleneck is the MD4 algorithm itself (not sure whether in the “tridge” rsync client, or in gokr-rsyncd). In my tests, gokr-rsyncd can easily transfer data at > 6 Gbit/s. Transfer complete: 5.5 KB sent, 1.2 KB read, 666 B file size
Socket.c:109: warning: connect refused: ::1, localhost % openrsync -v -archive -port 8730 rsync://localhost/pwd/ quine To serve the current directory via rsync on localhost:8730, use: Original “tridge” implementation I found older versions easier to studyĪrchived, internet draft RFC “The rsync Network Protocol” This project accepts contributions as time permits to merge them (best effort).Įxisting rsync implementation survey Language rsync daemon is a custom (un-standardized) network protocol, running on port 873 by default. The only component currently is gokr-rsyncd, a read-only rsync daemon sender-only Go implementation of rsyncd. Package rsync contains a native Go rsync implementation.īeware: very fresh.
0 kommentar(er)
