<div class="gmail_quote">On Sat, May 29, 2010 at 10:49 AM, Tomasz Chmielewski <span dir="ltr"><<a href="mailto:mangoo@wpkg.org">mangoo@wpkg.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">Still, if I understand correctly, I would need plain text passwords in the database?</div>
<br>
I.e. I wouldn't be able to use a md5 / sha password from some other user auth system without changing rsync protocol?</blockquote><div><br></div><div>Right. It should be possible to isolate the password onto the db box (i.e. never send the pass to the server running the rsync daemon) if you replaced the function-pair get_secret() and generate_hash() in rsync with a db query that used a sql function on the db server to run those steps (it would receive a module, a user, and a challenge string, and would return a hash). If your db could be configured to never return the password secret via select while still allowing the auth function to access it, that would at least isolate the password onto a more secure box. But, of course, the password would still have to be there.</div>
<div><br></div><div>If you want to actually not have the password anywhere on any server, we'd need to change the auth method (as you suspected). It would be nice to add something like that as an option to rsync that a daemon could be configured to use. If anyone has a suggested auth method, let me know.</div>
<div><br></div></div>..wayne..<br>