Prev: cat for binary file
Next: Sluggish USB hard drives
From: The Natural Philosopher on 11 Feb 2010 05:37
Chris Davies wrote:
> The Natural Philosopher <tnp(a)invalid.invalid> wrote:
>> Oh, I don't care about encrypting the data.
>
> That's fine by me (it's your data). I was simply querying your belief
> that rsync provided an encrypted stream.
>

Oh, OK.

No. Its presumably compressed, but no, I didn't expect encryption.

99% of the hack attacks on systems we have on the net are probes to well
known ports, and ssh shows up on many. But 'Ive never seen an rsync port
probed yet.

Most of them seem to be bots looking for sloppy setups - windows
machines with no security or routers with remote admin on, and default
passwords.

I am less concerned about people deliberately trying to read my data,
than in people gaining access to the machines at root level.

The nice thing about rsync is that it can use an entirely separate
password. So even if rsync itself were compromised, all they could do
with that is execute an rsync session, but they would have to fake my IP
address to do it. Not trivial that.

AND the worst they could do with that, is mess with the (already backed
up by rsync) data area.

which is less a problem than if they messed with the entire machine.

As with all security, its a question of working out what exact risk you
want to avoid, and not getting bogged down in securing the door, so to
speak, to find the upstairs window left open.

Still its always worth it to have a critrque of the policy one uses, in
case one has left out something.

There are only three things I really care about.

- loss of personal data by deliberate deletion or machine crash - hence
rsync at all.

- access to third party data on the databases. That is encrypted where
necessary and so not really accessible even if they pulled the whole
database down and pored over it.

- the number one disaster, would be root access to either of the
machines involved. All bets are off at that level. Hence my
unwillingness to open up a generic shell account on either. Despite the
fact that it is allegedly secure.

Obviously I do have a shell account on the remote machine, but it is
opened as and when necessary, and isn't where it might be expected to be.

That leaves the boundary router as the last vulnerability, but that
admin is also on an unexpected port, and keyed to my IP address only.
And tends to change as its on dynamic IP.

Nothing is unhackable, but it would be hard to fight through that lot,
and someone would really have to hate us to make the effort.












> Cheers,
> Chris
First  |  Prev  | 
Pages: 1 2 3
Prev: cat for binary file
Next: Sluggish USB hard drives