Demonstration based on rsync protocol¶

In vsftpd, there are virtual users (impersonated users customized by the administrator) because it is not safe to use anonymous users and local users. We know that a server based on the SSH protocol must ensure that there is a system of users. When there are many synchronization requirements, it may be necessary to create many users. This obviously does not meet the GNU/Linux operation and maintenance standards (the more users, the more insecure), in rsync, for security reasons, there is an rsync protocol authentication login method.

How to do it?

Just write the corresponding parameters and values in the configuration file. In Rocky Linux 8, you need to manually create the file /etc/rsyncd.conf.


[root@Rocky ~]# touch /etc/rsyncd.conf
[root@Rocky ~]# vim /etc/rsyncd.conf

Some parameters and values of this file are as follows, here has more parameter descriptions:

Item	Description
address = 192.168.100.4	The IP address that rsync listens on by default
port = 873	rsync default listening port
pid file = /var/run/rsyncd.pid	File location of process pid
log file = /var/log/rsyncd.log	File location of the log
[share]	Share name
comment = rsync	Remarks or description information
path = /rsync/	The system path location where it is located
read only = yes	yes means read only, no means read and write
dont compress = .gz .gz2 *.zip	Which file types do not compress it
auth users = li	Enable virtual users and define what a virtual user is called. Need to create it yourself
secrets file = /etc/rsyncd_users.db	Used to specify the location of the virtual user's password file, which must end in .db. The content format of the file is "Username: Password", one per line

tip

The permission of the password file must be 600.

Write some file content to /etc/rsyncd.conf, and write the user name and password to /etc/rsyncd_users.db, the permission is 600


[root@Rocky ~]# cat /etc/rsyncd.conf
address = 192.168.100.4
port = 873
pid file = /var/run/rsyncd.pid
log file = /var/log/rsyncd.log
[share]
comment = rsync
path = /rsync/
read only = yes
dont compress = *.gz *.bz2 *.zip
auth users = li
secrets file = /etc/rsyncd_users.db
[root@Rocky ~]# ll /etc/rsyncd_users.db
-rw------- 1 root root 9 November 2 16:16 /etc/rsyncd_users.db
[root@Rocky ~]# cat /etc/rsyncd_users.db
li:13579

You may need to dnf -y install rsync-daemon before you can start the service: systemctl start rsyncd.service


[root@Rocky ~]# systemctl start rsyncd.service
[root@Rocky ~]# netstat -tulnp
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      691/sshd            
tcp        0      0 192.168.100.4:873       0.0.0.0:*               LISTEN      4607/rsync          
tcp6       0      0 :::22                   :::*                    LISTEN      691/sshd            
udp        0      0 127.0.0.1:323           0.0.0.0:*                           671/chronyd         
udp6       0      0 ::1:323                 :::*                                671/chronyd

pull/download¶

Create a file in the server for verification: [root@Rocky]# touch /rsync/rsynctest.txt

The client does the following:


[root@fedora ~]# rsync -avz li@192.168.100.4::share /root
Password:
receiving incremental file list
./
rsynctest.txt
sent 52 bytes received 195 bytes 7.16 bytes/sec
total size is 883 speedup is 3.57
[root@fedora ~]# ls
aabbcc anaconda-ks.cfg fedora rsynctest.txt

success! In addition to the above writing based on the rsync protocol, you can also write like this: rsync://li@10.1.2.84/share

push/upload¶


[root@fedora ~]# touch /root/fedora.txt
[root@fedora ~]# rsync -avz /root/* li@192.168.100.4::share
Password:
sending incremental file list
rsync: [sender] read error: Connection reset by peer (104)
rsync error: error in socket IO (code 10) at io.c(784) [sender = 3.2.3]

You are prompted that the reading error is related to the "read only = yes" of the server . Change it to "no" and restart the service [root@Rocky ~]# systemctl restart rsyncd.service

Try again, prompting you permission denied:


[root@fedora ~]# rsync -avz /root/* li@192.168.100.4::share
Password:
sending incremental file list
fedora.txt
rsync: mkstemp " /.fedora.txt.hxzBIQ " (in share) failed: Permission denied (13)
sent 206 bytes received 118 bytes 92.57 bytes/sec
total size is 883 speedup is 2.73
rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1330) [sender = 3.2.3]

Our virtual user here is li, which is mapped to the system user nobody by default. Of course, you can change it to other system users. In other words, nobody does not have write permission to the /rsync/ directory. Of course, we can use [root@Rocky ~]# setfacl -mu:nobody:rwx /rsync/ , try again, and succeed.


[root@fedora ~]# rsync -avz /root/* li@192.168.100.4::share
Password:
sending incremental file list
fedora.txt
sent 206 bytes received 35 bytes 96.40 bytes/sec
total size is 883 speedup is 3.66

Author: tianci li

Contributors: Steven Spencer, Ganna Zhyrnova