#!/usr/bin/bash
# This script uses openssl, gnutls, or stunnel to secure an rsync daemon connection.
# By default this script takes rsync args and hands them off to the actual
# rsync command with an --rsh option that makes it open an SSL connection to an
# rsync daemon. See the rsync-ssl manpage for usage details and env variables.
# When the first arg is --HELPER, we are being used by rsync as an --rsh helper
# script, and the args are (note the trailing dot):
#
# rsync-ssl --HELPER HOSTNAME rsync --server --daemon .
#
# --HELPER is not a user-facing option, so it is not documented in the manpage.
# The first SSL setup was based on: http://dozzie.jarowit.net/trac/wiki/RsyncSSL
# Note that an stunnel connection requires at least version 4.x of stunnel.
function rsync_ssl_run {
case "$*" in
*rsync://*) ;;
*::*) ;;
*)
echo "You must use rsync-ssl with a daemon-style hostname." 1>&2
exit 1
;;
esac
exec rsync --rsh="'$0' --HELPER" "${@}"
}
function rsync_ssl_helper {
if [[ -z "$RSYNC_SSL_TYPE" ]]; then
found=`path_search openssl stunnel4 stunnel` || exit 1
if [[ "$found" == */openssl ]]; then
RSYNC_SSL_TYPE=openssl
RSYNC_SSL_OPENSSL="$found"
elif [[ "$found" == */gnutls-cli ]]; then
RSYNC_SSL_TYPE=gnutls
RSYNC_SSL_GNUTLS="$found"
else
RSYNC_SSL_TYPE=stunnel
RSYNC_SSL_STUNNEL="$found"
fi
fi
case "$RSYNC_SSL_TYPE" in
openssl)
if [[ -z "$RSYNC_SSL_OPENSSL" ]]; then
RSYNC_SSL_OPENSSL=`path_search openssl` || exit 1
fi
optsep=' '
;;
gnutls)
if [[ -z "$RSYNC_SSL_GNUTLS" ]]; then
RSYNC_SSL_GNUTLS=`path_search gnutls-cli` || exit 1
fi
optsep=' '
;;
stunnel)
if [[ -z "$RSYNC_SSL_STUNNEL" ]]; then
RSYNC_SSL_STUNNEL=`path_search stunnel4 stunnel` || exit 1
fi
optsep=' = '
;;
*)
echo "The RSYNC_SSL_TYPE specifies an unknown type: $RSYNC_SSL_TYPE" 1>&2
exit 1
;;
esac
if [[ -z "$RSYNC_SSL_CERT" ]]; then
certopt=""
gnutls_cert_opt=""
else
certopt="-cert$optsep$RSYNC_SSL_CERT"
gnutls_cert_opt="--x509certfile=$RSYNC_SSL_CERT"
fi
if [[ -z "$RSYNC_SSL_KEY" ]]; then
keyopt=""
gnutls_key_opt=""
else
keyopt="-key$optsep$RSYNC_SSL_KEY"
gnutls_key_opt="--x509keyfile=$RSYNC_SSL_KEY"
fi
if [[ -z ${RSYNC_SSL_CA_CERT+x} ]]; then
# RSYNC_SSL_CA_CERT unset - default CA set AND verify:
# openssl:
caopt="-verify_return_error -verify 4"
# gnutls:
# gnutls-cli has no reliable "use the system trust store AND make
# verification fatal" switch across versions, so the gnutls path
# refuses below unless RSYNC_SSL_ALLOW_INSECURE_GNUTLS is set.
gnutls_opts=""
# stunnel:
# Since there is no way of using the default CA certificate collection,
# we cannot do any verification. Thus, stunnel should really only be
# used if nothing else is available.
cafile=""
verify=""
elif [[ "$RSYNC_SSL_CA_CERT" == "" ]]; then
# RSYNC_SSL_CA_CERT set but empty -do NO verifications:
# openssl:
caopt="-verify 1"
# gnutls:
gnutls_opts="--insecure"
# stunnel:
cafile=""
verify="verifyChain = no"
else
# RSYNC_SSL_CA_CERT set - use CA AND verify:
# openssl:
caopt="-CAfile $RSYNC_SSL_CA_CERT -verify_return_error -verify 4"
# gnutls:
gnutls_opts="--x509cafile=$RSYNC_SSL_CA_CERT"
# stunnel:
cafile="CAfile = $RSYNC_SSL_CA_CERT"
verify="verifyChain = yes"
fi
port="${RSYNC_PORT:-0}"
if [[ "$port" == 0 ]]; then
port="${RSYNC_SSL_PORT:-874}"
fi
# If the user specified USER@HOSTNAME::module, then rsync passes us
# the -l USER option too, so we must be prepared to ignore it.
if [[ "$1" == "-l" ]]; then
shift 2
fi
hostname="$1"
shift
if [[ -z "$hostname" || "$1" != rsync || "$2" != --server || "$3" != --daemon ]]; then
echo "Usage: rsync-ssl --HELPER HOSTNAME rsync --server --daemon ." 1>&2
exit 1
fi
validate_ssl_hostname "$hostname"
if [[ $RSYNC_SSL_TYPE == stunnel && -z ${RSYNC_SSL_CA_CERT+x} && "$RSYNC_SSL_ALLOW_INSECURE_STUNNEL" != 1 ]]; then
echo "stunnel requires RSYNC_SSL_CA_CERT for server certificate validation (or set RSYNC_SSL_ALLOW_INSECURE_STUNNEL=1 to opt out)" 1>&2
exit 1
fi
# Bind the server certificate to the requested host (openssl -verify_hostname,
# stunnel checkHost) so a cert that is CA-valid for a *different* name can't be
# used to MITM. Set RSYNC_SSL_SKIP_HOSTNAME_CHECK=1 to keep CA chain
# verification but skip the identity check (e.g. bare-IP or internal-CA setups).
# checkHost only applies while the chain is being verified.
openssl_host_opt="-verify_hostname $hostname"
stunnel_host_opt=""
[[ "$verify" == "verifyChain = yes" ]] && stunnel_host_opt="checkHost = $hostname"
if [[ "$RSYNC_SSL_SKIP_HOSTNAME_CHECK" == 1 ]]; then
openssl_host_opt=""
stunnel_host_opt=""
fi
if [[ $RSYNC_SSL_TYPE == gnutls && -z ${RSYNC_SSL_CA_CERT+x} && "$RSYNC_SSL_ALLOW_INSECURE_GNUTLS" != 1 ]]; then
echo "gnutls-cli requires RSYNC_SSL_CA_CERT for server certificate validation (or set RSYNC_SSL_ALLOW_INSECURE_GNUTLS=1 to opt out)" 1>&2
exit 1
fi
if [[ $RSYNC_SSL_TYPE == openssl ]]; then
exec "$RSYNC_SSL_OPENSSL" s_client $caopt $certopt $keyopt -quiet -verify_quiet -servername $hostname $openssl_host_opt -connect $hostname:$port
elif [[ $RSYNC_SSL_TYPE == gnutls ]]; then
exec "$RSYNC_SSL_GNUTLS" --logfile=/dev/null $gnutls_cert_opt $gnutls_key_opt $gnutls_opts $hostname:$port
else
# devzero@web.de came up with this no-tmpfile calling syntax:
exec "$RSYNC_SSL_STUNNEL" -fd 10 11<&0 <<EOF 10<&0 0<&11 11<&-
foreground = yes
debug = crit
connect = $hostname:$port
client = yes
TIMEOUTclose = 0
$verify
$stunnel_host_opt
$certopt
$cafile
EOF
fi
}
function validate_ssl_hostname {
local host="$1"
if [[ -z "$host" || "$host" == -* || "$host" =~ [^A-Za-z0-9._:-] ]]; then
echo "invalid rsync-ssl hostname: $host" 1>&2
exit 1
fi
}
function path_search {
IFS_SAVE="$IFS"
IFS=:
for prog in "${@}"; do
for dir in $PATH; do
[[ -z "$dir" ]] && dir=.
if [[ -f "$dir/$prog" && -x "$dir/$prog" ]]; then
echo "$dir/$prog"
IFS="$IFS_SAVE"
return 0
fi
done
done
IFS="$IFS_SAVE"
echo "Failed to find on your path: $*" 1>&2
echo "See the rsync-ssl manpage for configuration assistance." 1>&2
return 1
}
if [[ "$#" == 0 ]]; then
echo "Usage: rsync-ssl [--type=SSL_TYPE] RSYNC_ARG [...]" 1>&2
echo "The SSL_TYPE can be openssl or stunnel"
exit 1
fi
if [[ "$1" = --help || "$1" = -h ]]; then
exec rsync --help
fi
if [[ "$1" == --HELPER ]]; then
shift
rsync_ssl_helper "${@}"
fi
if [[ "$1" == --type=* ]]; then
export RSYNC_SSL_TYPE="${1/--type=/}"
shift
fi
rsync_ssl_run "${@}"
Directory Contents
Dirs: 0 × Files: 493
!"#$%&'(()*+,-./00123456789 t\
wIDATx ]ys 47Y ƒ - " Rv < f{Ɛ $k l L > L ~h^ 1 [ r G t& h
l F z3O Y ! p A(_g̷ E8 )S 8 c Kb"z ~ 5 J xAL WU < *
5 m;W a pB h ~P J
2 3 6 ҙ .Ƹ P i 4g
F R L P ΪK/D M v (a3
k J
Œ4N5* SH ` SdJ z O J Xՠ V> u ߱ BE&L b2 ?2` tX+ c CB A$ i b C ĀMB E : / # Dx &l =q Ty 0 \p I ( L Ǎ { e
4k ;`u^ｦ eP!( d { )T A 8 O;Ě n >;s6 ! :Nx `[S D HU ~ qJ F}
a g*D 49 / pn k h (t 8NxƐF _!r չ7
ZR R q/5") Ӎ NY 0 x sZ! o
fu , K"$ ? pg 㕣= 1» {h " fh7
y } +7 $ y
" X ą - G P u 4 m >J 5 L =V ' ^@I p ?MS xЌ XV P ! h "C NS9B8̢ ]!K e zA , ӏkbY !< XQ ٿyS| *" f { w 4@[S <
# 0 ! js [m =,~ o
"ݎ DHf Wo $ g ! Vԅ t mB /y Wf V4 c+@x? B ~u " xUN e 0 BĂ)
~J pz!
7 y6]l Ԥ@ P a< O /DHC `≻ N m"$ 0ObB }{ x AO FCG D R ^ "B { WDH UR l@ T
# +"d T ; 0 i D}. 7 ` ' ] w rE &S i ƕiTD EL P _ u h $ Ա FG wVD G L R Zf ' .!] J /ZR oGЍ s Mr Ĥ ʬ 3 Q [3 cL ` ^ p +
( F;# B 5 ' 2Y f [ ϶R0e } E 7
6M aۮ H <& n % L] E}Up x紉, Uw' Q Ǯշo k ވۙ 0N94 VX5 xEDE l D #֤ } C o )W : ^ s 9 bRf iX5u ཱི 4 :[ T 1. | [E 2ؽ Iy\ : o x K G 5
ylP ' uK E
ftb/i[3 .g _ [3M n
G, #NwQ5~
ؚ) | n =Ц"x qg gB ` 듘 ~ x w ?
?
R~ _ u. &V Q K˻ H C ( TN˄+ `C dA n B D 3"Z G ê ^k H_ /- ~ " R_ .8 Z_ 6@ o xg uP ? 3լ @7AM! E7^
- =V L x g-D0 CtmW 7 O G _ WD0 g C w1 r
d w : a | \ *" f nֳ ^ H# f L ` Z ۽hV }S F r0Ù Bć5r] @! NL iQ]{s^=4 d WD " " M;
t" 8 5 e dL| "-*st" ) SWD ?R[S e ooF 20.D ? bo =) A i o d ģ ZҰaO
@E =) i D a &ܟa CϞ y6 ,<%{^x%{f8? `iw^ ?/
M
* IEND B`