6 messages in org.samba.lists.rsyncRestricting rsync over ssh
FromSent OnAttachments
BobDec 28, 2004 3:53 pm 
Dmitry V. LevinDec 28, 2004 4:12 pm 
BobDec 28, 2004 4:24 pm 
Dmitry V. LevinDec 28, 2004 4:43 pm 
Alessandro RanellucciDec 28, 2004 4:44 pm 
Martin ScharrerDec 28, 2004 5:26 pm 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:Restricting rsync over sshActions
From:Dmitry V. Levin (ld@altlinux.org)
Date:Dec 28, 2004 4:43:24 pm
List:org.samba.lists.rsync

On Tue, Dec 28, 2004 at 05:24:27PM +0100, Bob wrote:

I would like to avoid using chroot because it implies my dummy-shell must run in suid root. Furthermore, it forces to create a jail with the binaries and libraries inside. I was thinking to this solution to avoid doing this.

Is there any reason to avoid this jail solution?

Do you think there are some security issues using realpath instead of chroot ?

Yes, realpath introduces time-of-check-time-of-use race condition: during the check your canonical path is fine, then user changes some symlinks (using shell or via rsync) and gets out of his home directory.

-- ldv