12

If a remote server has been "hardened" such that the only way to access the server is through a public key SSH connection and sensitive files (e.g. SSL private keys, databases etc) on the server were being copied using command line rsync, will those files will be securely transported inside the ssh "tunnel"?

My guess is that, surely, the only way for rsync to even connect into the box is if it attaches to the remote SSH daemon, and successfully authenticates itself, and that from that point all transfers must be wrapped inside the SSH encryption, but my concern is whether or not rsync has been intentionally implemented to be secure and not leak information. Or, on the other hand, the developers of rsync merely made rsync compatible with SSH in order to get the job done, and would be willing to sacrifice security, say for the purpose of increasing efficiency or compression?

Can rsync be considered a secure method of transferring files in this situation?

Improve this question
3
  • What you are asking can only be answered by a code review of the rsync source code to check if it's delegating to the ssh executable on the machine (which is preferable) or if it's using an embedded version of ssh (which could potentially be unsafe if is has not up to date)
    – ARau
    Jun 1, 2017 at 1:43
  • I was using rsync in different way. I openned the SSH with TCP tunnel and used it to transfer the data over it using rsync. But its about 5 years ago so I don't remember exactly :(
    – Fis
    Jun 1, 2017 at 1:49
  • @blownie55 well sure, auditing the code would give a rigorous and independent analysis,but to me higher level, common sense answer would also be fine. e.g. an example of a technically knowledgeable organisation using it for file transfers, a statement from the rsync developers themselves etc
    – the_velour_fog
    Jun 1, 2017 at 1:55

2 Answers 2

Reset to default
20

Rsync over ssh is intended to be secure, and operates by opening a tunnel via ssh, securing the entire transfer. It doesn't use its own built in protocol but uses the actual ssh implementation on the computer itself. It is safe to assume that rsync over ssh is secure in exactly the same way that any other well maintained open source system built with security in mind is secure. Which is to say, it is very reasonable to trust it in this case, but any software can have bugs, so always keep your system up-to-date.

https://unix.stackexchange.com/questions/197684/how-does-rysnc-work-over-ssh

Improve this answer
6

Short answer: yes.

The scheme is secure by design for the intended scope (encrypted during transfer). As always, that doesn't mean your files will be totally secure. Being aware and alert helps. :)

e.g.,

  1. Both SSH and rsync implementations have been around for a long time. No red flags there in terms of security vulnerabilities. Who knows what the future will turn up?
  2. The implementation of the scheme itself could introduce vulnerabilities (i.e., misconfigured servers / misconfigured SSH / mishandled keys).
Improve this answer
1
  • 2
    "Who knows", indeed, but we have seen previous attacks against open-source security systems (eg Heartbleed, for which a patch was available within a couple of weeks), so even if something critically dangerous is discovered, you can be fairly confident that people are going to fix it.
    – rosuav
    Jun 1, 2017 at 10:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .