RSYNC: Backup Solution thoughts...

[Philip Mak]

If I understand correctly, you're saying that if someone manages to gain
access to my rsync server, they can read my password files and private
keys, right?

How would they accomplish gaining access to my rsync server, though? Only
my backup server would be authorized to connect to it...

I think I *do* want to back up /etc/shadow actually, because this is a
full system backup that's meant to be able to be used to restore the
system in case of hard drive failure. If I didn't include /etc/shadow,
then everyone would lose their passwords.

On Tue, 18 Dec 2001 tim.conway at philips.com wrote:

> readonly full disk.
> rsync yourhost::rootmodule/etc/shadow .
> satan -f ./shadow
> telnet yourhost
> login as user
> su -
> f*** you over.
>
> what, no telnet, only ssh?
> grab an identity file and ssh in.
>
> yes, it's bad... at least, exclude secure areas.