Re: ssh and root logins
* Stephen Gran (sgran@debian.org) [040810 17:40]:
> This one time, at band camp, Bernard Blackham said:
> > This lets the backup key *only* run rsync in server mode. I
> > /believe/ this means that (short of finding a buffer overflow in
> > rsync) logins with this ssh key will only be able to read files, and
> > not be able to change anything. Though if anybody can find any flaws
> > in this scheme, I'd like to know :)
> As is kind of obvious, if I can compromise that key, I can do
> rsync -e ssh --delete /some/empty/dir root@yourhost:/
> or something, which isn't very nice :)
I use commands like
command="rsync --server -logDtpr --delete . /home/aba/bts/spohr/data"
So I know exactly what directory can be changed and what not. (For
backup rsyncs, you can just fix it on the other direction, so not so
much harm can be done, because only write, and no read is possible.)
Cheers,
Andi
--
http://home.arcor.de/andreas-barth/
PGP 1024/89FB5CE5 DC F1 85 6D A6 45 9C 0F 3B BE F1 D0 C5 D1 D9 0C
Reply to: