🗂️ simple
Path:
usr
/
bin
/
✏️ Editing: rsync-ssl
#!/usr/bin/bash # This script uses openssl, gnutls, or stunnel to secure an rsync daemon connection. # By default this script takes rsync args and hands them off to the actual # rsync command with an --rsh option that makes it open an SSL connection to an # rsync daemon. See the rsync-ssl manpage for usage details and env variables. # When the first arg is --HELPER, we are being used by rsync as an --rsh helper # script, and the args are (note the trailing dot): # # rsync-ssl --HELPER HOSTNAME rsync --server --daemon . # # --HELPER is not a user-facing option, so it is not documented in the manpage. # The first SSL setup was based on: http://dozzie.jarowit.net/trac/wiki/RsyncSSL # Note that an stunnel connection requires at least version 4.x of stunnel. function rsync_ssl_run { case "$*" in *rsync://*) ;; *::*) ;; *) echo "You must use rsync-ssl with a daemon-style hostname." 1>&2 exit 1 ;; esac exec rsync --rsh="'$0' --HELPER" "${@}" } function rsync_ssl_helper { if [[ -z "$RSYNC_SSL_TYPE" ]]; then found=`path_search openssl stunnel4 stunnel` || exit 1 if [[ "$found" == */openssl ]]; then RSYNC_SSL_TYPE=openssl RSYNC_SSL_OPENSSL="$found" elif [[ "$found" == */gnutls-cli ]]; then RSYNC_SSL_TYPE=gnutls RSYNC_SSL_GNUTLS="$found" else RSYNC_SSL_TYPE=stunnel RSYNC_SSL_STUNNEL="$found" fi fi case "$RSYNC_SSL_TYPE" in openssl) if [[ -z "$RSYNC_SSL_OPENSSL" ]]; then RSYNC_SSL_OPENSSL=`path_search openssl` || exit 1 fi optsep=' ' ;; gnutls) if [[ -z "$RSYNC_SSL_GNUTLS" ]]; then RSYNC_SSL_GNUTLS=`path_search gnutls-cli` || exit 1 fi optsep=' ' ;; stunnel) if [[ -z "$RSYNC_SSL_STUNNEL" ]]; then RSYNC_SSL_STUNNEL=`path_search stunnel4 stunnel` || exit 1 fi optsep=' = ' ;; *) echo "The RSYNC_SSL_TYPE specifies an unknown type: $RSYNC_SSL_TYPE" 1>&2 exit 1 ;; esac if [[ -z "$RSYNC_SSL_CERT" ]]; then certopt="" gnutls_cert_opt="" else certopt="-cert$optsep$RSYNC_SSL_CERT" gnutls_cert_opt="--x509certfile=$RSYNC_SSL_CERT" fi if [[ -z "$RSYNC_SSL_KEY" ]]; then keyopt="" gnutls_key_opt="" else keyopt="-key$optsep$RSYNC_SSL_KEY" gnutls_key_opt="--x509keyfile=$RSYNC_SSL_KEY" fi if [[ -z ${RSYNC_SSL_CA_CERT+x} ]]; then # RSYNC_SSL_CA_CERT unset - default CA set AND verify: # openssl: caopt="-verify_return_error -verify 4" # gnutls: # gnutls-cli has no reliable "use the system trust store AND make # verification fatal" switch across versions, so the gnutls path # refuses below unless RSYNC_SSL_ALLOW_INSECURE_GNUTLS is set. gnutls_opts="" # stunnel: # Since there is no way of using the default CA certificate collection, # we cannot do any verification. Thus, stunnel should really only be # used if nothing else is available. cafile="" verify="" elif [[ "$RSYNC_SSL_CA_CERT" == "" ]]; then # RSYNC_SSL_CA_CERT set but empty -do NO verifications: # openssl: caopt="-verify 1" # gnutls: gnutls_opts="--insecure" # stunnel: cafile="" verify="verifyChain = no" else # RSYNC_SSL_CA_CERT set - use CA AND verify: # openssl: caopt="-CAfile $RSYNC_SSL_CA_CERT -verify_return_error -verify 4" # gnutls: gnutls_opts="--x509cafile=$RSYNC_SSL_CA_CERT" # stunnel: cafile="CAfile = $RSYNC_SSL_CA_CERT" verify="verifyChain = yes" fi port="${RSYNC_PORT:-0}" if [[ "$port" == 0 ]]; then port="${RSYNC_SSL_PORT:-874}" fi # If the user specified USER@HOSTNAME::module, then rsync passes us # the -l USER option too, so we must be prepared to ignore it. if [[ "$1" == "-l" ]]; then shift 2 fi hostname="$1" shift if [[ -z "$hostname" || "$1" != rsync || "$2" != --server || "$3" != --daemon ]]; then echo "Usage: rsync-ssl --HELPER HOSTNAME rsync --server --daemon ." 1>&2 exit 1 fi validate_ssl_hostname "$hostname" if [[ $RSYNC_SSL_TYPE == stunnel && -z ${RSYNC_SSL_CA_CERT+x} && "$RSYNC_SSL_ALLOW_INSECURE_STUNNEL" != 1 ]]; then echo "stunnel requires RSYNC_SSL_CA_CERT for server certificate validation (or set RSYNC_SSL_ALLOW_INSECURE_STUNNEL=1 to opt out)" 1>&2 exit 1 fi # Bind the server certificate to the requested host (openssl -verify_hostname, # stunnel checkHost) so a cert that is CA-valid for a *different* name can't be # used to MITM. Set RSYNC_SSL_SKIP_HOSTNAME_CHECK=1 to keep CA chain # verification but skip the identity check (e.g. bare-IP or internal-CA setups). # checkHost only applies while the chain is being verified. openssl_host_opt="-verify_hostname $hostname" stunnel_host_opt="" [[ "$verify" == "verifyChain = yes" ]] && stunnel_host_opt="checkHost = $hostname" if [[ "$RSYNC_SSL_SKIP_HOSTNAME_CHECK" == 1 ]]; then openssl_host_opt="" stunnel_host_opt="" fi if [[ $RSYNC_SSL_TYPE == gnutls && -z ${RSYNC_SSL_CA_CERT+x} && "$RSYNC_SSL_ALLOW_INSECURE_GNUTLS" != 1 ]]; then echo "gnutls-cli requires RSYNC_SSL_CA_CERT for server certificate validation (or set RSYNC_SSL_ALLOW_INSECURE_GNUTLS=1 to opt out)" 1>&2 exit 1 fi if [[ $RSYNC_SSL_TYPE == openssl ]]; then exec "$RSYNC_SSL_OPENSSL" s_client $caopt $certopt $keyopt -quiet -verify_quiet -servername $hostname $openssl_host_opt -connect $hostname:$port elif [[ $RSYNC_SSL_TYPE == gnutls ]]; then exec "$RSYNC_SSL_GNUTLS" --logfile=/dev/null $gnutls_cert_opt $gnutls_key_opt $gnutls_opts $hostname:$port else # devzero@web.de came up with this no-tmpfile calling syntax: exec "$RSYNC_SSL_STUNNEL" -fd 10 11<&0 <<EOF 10<&0 0<&11 11<&- foreground = yes debug = crit connect = $hostname:$port client = yes TIMEOUTclose = 0 $verify $stunnel_host_opt $certopt $cafile EOF fi } function validate_ssl_hostname { local host="$1" if [[ -z "$host" || "$host" == -* || "$host" =~ [^A-Za-z0-9._:-] ]]; then echo "invalid rsync-ssl hostname: $host" 1>&2 exit 1 fi } function path_search { IFS_SAVE="$IFS" IFS=: for prog in "${@}"; do for dir in $PATH; do [[ -z "$dir" ]] && dir=. if [[ -f "$dir/$prog" && -x "$dir/$prog" ]]; then echo "$dir/$prog" IFS="$IFS_SAVE" return 0 fi done done IFS="$IFS_SAVE" echo "Failed to find on your path: $*" 1>&2 echo "See the rsync-ssl manpage for configuration assistance." 1>&2 return 1 } if [[ "$#" == 0 ]]; then echo "Usage: rsync-ssl [--type=SSL_TYPE] RSYNC_ARG [...]" 1>&2 echo "The SSL_TYPE can be openssl or stunnel" exit 1 fi if [[ "$1" = --help || "$1" = -h ]]; then exec rsync --help fi if [[ "$1" == --HELPER ]]; then shift rsync_ssl_helper "${@}" fi if [[ "$1" == --type=* ]]; then export RSYNC_SSL_TYPE="${1/--type=/}" shift fi rsync_ssl_run "${@}"
🔙 Back