Annotation of embedaddon/rsync/support/rrsync, revision 1.1
1.1 ! misho 1: #!/usr/bin/perl
! 2: # Name: /usr/local/bin/rrsync (should also have a symlink in /usr/bin)
! 3: # Purpose: Restricts rsync to subdirectory declared in .ssh/authorized_keys
! 4: # Author: Joe Smith <js-cgi@inwap.com> 30-Sep-2004
! 5: # Modified by: Wayne Davison <wayned@samba.org>
! 6: use strict;
! 7:
! 8: use Socket;
! 9: use Cwd 'abs_path';
! 10: use File::Glob ':glob';
! 11:
! 12: # You may configure these values to your liking. See also the section
! 13: # of options if you want to disable any options that rsync accepts.
! 14: use constant RSYNC => '/usr/bin/rsync';
! 15: use constant LOGFILE => 'rrsync.log';
! 16:
! 17: my $Usage = <<EOM;
! 18: Use 'command="$0 [-ro] SUBDIR"'
! 19: in front of lines in $ENV{HOME}/.ssh/authorized_keys
! 20: EOM
! 21:
! 22: our $ro = (@ARGV && $ARGV[0] eq '-ro') ? shift : ''; # -ro = Read-Only
! 23: our $subdir = shift;
! 24: die "$0: No subdirectory specified\n$Usage" unless defined $subdir;
! 25: $subdir = abs_path($subdir);
! 26: die "$0: Restricted directory does not exist!\n" if $subdir ne '/' && !-d $subdir;
! 27:
! 28: # The client uses "rsync -av -e ssh src/ server:dir/", and sshd on the server
! 29: # executes this program when .ssh/authorized_keys has 'command="..."'.
! 30: # For example:
! 31: # command="rrsync logs/client" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAzGhEeNlPr...
! 32: # command="rrsync -ro results" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAmkHG1WCjC...
! 33: #
! 34: # Format of the envrionment variables set by sshd:
! 35: # SSH_ORIGINAL_COMMAND=rsync --server -vlogDtpr --partial . ARG # push
! 36: # SSH_ORIGINAL_COMMAND=rsync --server --sender -vlogDtpr --partial . ARGS # pull
! 37: # SSH_CONNECTION=client_addr client_port server_port
! 38:
! 39: my $command = $ENV{SSH_ORIGINAL_COMMAND};
! 40: die "$0: Not invoked via sshd\n$Usage" unless defined $command;
! 41: die "$0: SSH_ORIGINAL_COMMAND='$command' is not rsync\n" unless $command =~ s/^rsync\s+//;
! 42: die "$0: --server option is not first\n" unless $command =~ /^--server\s/;
! 43: our $am_sender = $command =~ /^--server\s+--sender\s/; # Restrictive on purpose!
! 44: die "$0 -ro: sending to read-only server not allowed\n" if $ro && !$am_sender;
! 45:
! 46: ### START of options data produced by the cull_options script. ###
! 47:
! 48: # These options are the only options that rsync might send to the server,
! 49: # and only in the option format that the stock rsync produces.
! 50:
! 51: # To disable a short-named option, add its letter to this string:
! 52: our $short_disabled = 's';
! 53:
! 54: our $short_no_arg = 'ACDEHIKLORSWXbcdgklmnoprstuvxz'; # DO NOT REMOVE ANY
! 55: our $short_with_num = 'B'; # DO NOT REMOVE ANY
! 56:
! 57: # To disable a long-named option, change its value to a -1. The values mean:
! 58: # 0 = the option has no arg; 1 = the arg doesn't need any checking; 2 = only
! 59: # check the arg when receiving; and 3 = always check the arg.
! 60: our %long_opt = (
! 61: 'append' => 0,
! 62: 'backup-dir' => 2,
! 63: 'bwlimit' => 1,
! 64: 'checksum-seed' => 1,
! 65: 'compare-dest' => 2,
! 66: 'compress-level' => 1,
! 67: 'copy-dest' => 2,
! 68: 'copy-unsafe-links' => 0,
! 69: 'daemon' => -1,
! 70: 'delay-updates' => 0,
! 71: 'delete' => 0,
! 72: 'delete-after' => 0,
! 73: 'delete-before' => 0,
! 74: 'delete-delay' => 0,
! 75: 'delete-during' => 0,
! 76: 'delete-excluded' => 0,
! 77: 'existing' => 0,
! 78: 'fake-super' => 0,
! 79: 'files-from' => 3,
! 80: 'force' => 0,
! 81: 'from0' => 0,
! 82: 'fuzzy' => 0,
! 83: 'iconv' => 1,
! 84: 'ignore-errors' => 0,
! 85: 'ignore-existing' => 0,
! 86: 'inplace' => 0,
! 87: 'link-dest' => 2,
! 88: 'list-only' => 0,
! 89: 'log-file' => 3,
! 90: 'log-format' => 1,
! 91: 'max-delete' => 1,
! 92: 'max-size' => 1,
! 93: 'min-size' => 1,
! 94: 'modify-window' => 1,
! 95: 'no-implied-dirs' => 0,
! 96: 'no-r' => 0,
! 97: 'no-relative' => 0,
! 98: 'no-specials' => 0,
! 99: 'numeric-ids' => 0,
! 100: 'only-write-batch' => 1,
! 101: 'partial' => 0,
! 102: 'partial-dir' => 2,
! 103: 'remove-sent-files' => $ro ? -1 : 0,
! 104: 'remove-source-files' => $ro ? -1 : 0,
! 105: 'safe-links' => 0,
! 106: 'sender' => 0,
! 107: 'server' => 0,
! 108: 'size-only' => 0,
! 109: 'skip-compress' => 1,
! 110: 'specials' => 0,
! 111: 'stats' => 0,
! 112: 'suffix' => 1,
! 113: 'super' => 0,
! 114: 'temp-dir' => 2,
! 115: 'timeout' => 1,
! 116: 'use-qsort' => 0,
! 117: );
! 118:
! 119: ### END of options data produced by the cull_options script. ###
! 120:
! 121: if ($short_disabled ne '') {
! 122: $short_no_arg =~ s/[$short_disabled]//go;
! 123: $short_with_num =~ s/[$short_disabled]//go;
! 124: }
! 125: $short_no_arg = "[$short_no_arg]" if length($short_no_arg) > 1;
! 126: $short_with_num = "[$short_with_num]" if length($short_with_num) > 1;
! 127:
! 128: my $write_log = -f LOGFILE && open(LOG, '>>', LOGFILE);
! 129:
! 130: chdir($subdir) or die "$0: Unable to chdir to restricted dir: $!\n";
! 131:
! 132: my(@opts, @args);
! 133: my $in_options = 1;
! 134: my $last_opt = '';
! 135: my $check_type;
! 136: while ($command =~ /((?:[^\s\\]+|\\.[^\s\\]*)+)/g) {
! 137: $_ = $1;
! 138: if ($check_type) {
! 139: push(@opts, check_arg($last_opt, $_, $check_type));
! 140: $check_type = 0;
! 141: } elsif ($in_options) {
! 142: push(@opts, $_);
! 143: if ($_ eq '.') {
! 144: $in_options = 0;
! 145: } else {
! 146: die "$0: invalid option: '-'\n" if $_ eq '-';
! 147: next if /^-$short_no_arg*(e\d*\.\w*)?$/o || /^-$short_with_num\d+$/o;
! 148:
! 149: my($opt,$arg) = /^--([^=]+)(?:=(.*))?$/;
! 150: my $disabled;
! 151: if (defined $opt) {
! 152: my $ct = $long_opt{$opt};
! 153: last unless defined $ct;
! 154: next if $ct == 0;
! 155: if ($ct > 0) {
! 156: if (!defined $arg) {
! 157: $check_type = $ct;
! 158: $last_opt = $opt;
! 159: next;
! 160: }
! 161: $arg = check_arg($opt, $arg, $ct);
! 162: $opts[-1] =~ s/=.*/=$arg/;
! 163: next;
! 164: }
! 165: $disabled = 1;
! 166: $opt = "--$opt";
! 167: } elsif ($short_disabled ne '') {
! 168: $disabled = /^-$short_no_arg*([$short_disabled])/o;
! 169: $opt = "-$1";
! 170: }
! 171:
! 172: last unless $disabled; # Generate generic failure
! 173: die "$0: option $opt has been disabled on this server.\n";
! 174: }
! 175: } else {
! 176: if ($subdir ne '/') {
! 177: # Validate args to ensure they don't try to leave our restricted dir.
! 178: s{//+}{/}g;
! 179: s{^/}{};
! 180: s{^$}{.};
! 181: die "$0: do not use .. in any path!\n" if m{(^|/)\\?\.\\?\.(\\?/|$)};
! 182: }
! 183: push(@args, bsd_glob($_, GLOB_LIMIT|GLOB_NOCHECK|GLOB_BRACE|GLOB_QUOTE));
! 184: }
! 185: }
! 186: die "$0: invalid rsync-command syntax or options\n" if $in_options;
! 187:
! 188: @args = ( '.' ) if !@args;
! 189:
! 190: if ($write_log) {
! 191: my ($mm,$hh) = (localtime)[1,2];
! 192: my $host = $ENV{SSH_CONNECTION} || 'unknown';
! 193: $host =~ s/ .*//; # Keep only the client's IP addr
! 194: $host =~ s/^::ffff://;
! 195: $host = gethostbyaddr(inet_aton($host),AF_INET) || $host;
! 196: printf LOG "%02d:%02d %-13s [%s]\n", $hh, $mm, $host, "@opts @args";
! 197: close LOG;
! 198: }
! 199:
! 200: # Note: This assumes that the rsync protocol will not be maliciously hijacked.
! 201: exec(RSYNC, @opts, @args) or die "exec(rsync @opts @args) failed: $? $!";
! 202:
! 203: sub check_arg
! 204: {
! 205: my($opt, $arg, $type) = @_;
! 206: $arg =~ s/\\(.)/$1/g;
! 207: if ($subdir ne '/' && ($type == 3 || ($type == 2 && !$am_sender))) {
! 208: $arg =~ s{//}{/}g;
! 209: die "Do not use .. in --$opt; anchor the path at the root of your restricted dir.\n"
! 210: if $arg =~ m{(^|/)\.\.(/|$)};
! 211: $arg =~ s{^/}{$subdir/};
! 212: }
! 213: $arg;
! 214: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to rrsync CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / rsync / support