2

Is there a security risk with running rsync as root to copy potentially malicious files? Or for that matter with any read command like cp, cat, du?

Background:
I'm moving data from various systems onto my new proxmox host (could be any debian based distro) for centralized storage. So I plugged the hdds into my new server and mounted them read-only to copy all files over to my new storage array with rsync. Among this data are files of family members which I don't control and that could have been compromised (not likely but possible).

Is there a problem here or am I way too paranoid?

1 Answer 1

0

If you care about preserving file owner, group, permissions, etc. you have no choice but to run rsync as root. If you don't have access to the directories they store their files in, you'll also need to use the superuser account. If you do have access to the files and use rsync as your non-admin user, it will change your user to the owner/group for those files.

I recommend running rsync as root using the -a to preserve the owner, group, permissions, etc.

If you use rsync correctly, even if the files were compromised, you wouldn't change the situation you're currently in. If you don't use -a or a combination of other switches you could be creating a security problem, and you will definitely be creating a sysadmin problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .