If a remote server has been "hardened" such that the only way to access the server is through a public key SSH connection and sensitive files (e.g. SSL private keys, databases etc) on the server were being copied using command line rsync
, will those files will be securely transported inside the ssh "tunnel"?
My guess is that, surely, the only way for rsync to even connect into the box is if it attaches to the remote SSH daemon, and successfully authenticates itself, and that from that point all transfers must be wrapped inside the SSH encryption, but my concern is whether or not rsync has been intentionally implemented to be secure and not leak information. Or, on the other hand, the developers of rsync merely made rsync compatible with SSH in order to get the job done, and would be willing to sacrifice security, say for the purpose of increasing efficiency or compression?
Can rsync
be considered a secure method of transferring files in this situation?