0
1
How do I encrypt the rsync connection using TLS? I don't have SSH access on the server and can't set up any services so stunnel is not an option, right? My provider simply to me to "Use a TLS tunnel".
Den
Posted 2012-07-09T17:32:49.327
Reputation: 323
1
What kind of access do you have to the server?
Assuming that there is some way to execute commands, you don't need to set up a service for stunnel, but can simply start that from the command line. It makes me wonder how secure that command-executiong access is, though, if it is not ssh. Having TLS-secured rsync is of little use if anyone can hack into the mashine using rsh, telnet or similar.
MvG
Posted 2012-07-09T17:32:49.327
Reputation: 1 259
The rsync protocol is often used over bare TCP, with rsyncd running on the server side. However, since it only supports plain-text authentication, it is usually limited to read-only mirroring. – user1686 – 2012-07-09T18:44:11.110
@grawity: When using rsync over TCP, someone has to start that server. If the system is configured to run that as a daemon, and not provide command line access either, then the OP is out of luck. Otherwise even a service started in this way could be wrapped into an stunnel. Forcing the use of the tunnel, i.e. preventing users from directly connecting the rsync server, might be more difficult unless the server or firewall configuration is under the OP's control. – MvG – 2012-07-09T18:59:57.910
I can't execute any thing on the server. I just have access over bare TCP (as grawity mentioned), FTP, WebDAV and a Website. – Den – 2012-07-11T03:35:55.263
I take it that you upload the website via FTP, and that the server has some scripting capabilities? If they don't restrict your scripts to a set of safe commands then you could probably start stunnel from a CGI script: Check a password, and if it is correct, start stunnel, tell the user to go a head, and provide him with a link to another CGI where he can stop stunnel again. – MvG – 2012-07-11T05:24:29.323
Nice idea but it is only a online storage. I guess I have to go back to the support and hope to get more info this time (they like to answer emails whit one word: done ;-)) – Den – 2012-07-12T03:13:40.000
0
have a look at RsyncSSL ( see thread at http://marc.info/?l=rsync&m=135923886723094&w=2 ) - but if you don`t have access on the server side, you are completely out of luck. i would ask the provider how setting up tls should work without access to that box
rolandk
Posted 2012-07-09T17:32:49.327
Reputation: 1
I got back to the support and now I know it is possible to open a SSH tunnel (but not log in whit SSH so I have to use the rsync protocol thought the SSH tunnel). Complicated but it works. – Den – 2012-07-27T03:37:11.017