JFIF$        dd7 

Viewing File: /usr/bin/rsync-ssl

#!/usr/bin/bash

# This script uses openssl, gnutls, or stunnel to secure an rsync daemon connection.

# By default this script takes rsync args and hands them off to the actual
# rsync command with an --rsh option that makes it open an SSL connection to an
# rsync daemon.  See the rsync-ssl manpage for usage details and env variables.

# When the first arg is --HELPER, we are being used by rsync as an --rsh helper
# script, and the args are (note the trailing dot):
#
#    rsync-ssl --HELPER HOSTNAME rsync --server --daemon .
#
# --HELPER is not a user-facing option, so it is not documented in the manpage.

# The first SSL setup was based on:  http://dozzie.jarowit.net/trac/wiki/RsyncSSL
# Note that an stunnel connection requires at least version 4.x of stunnel.

function rsync_ssl_run {
    case "$*" in
    *rsync://*) ;;
    *::*) ;;
    *)
	echo "You must use rsync-ssl with a daemon-style hostname." 1>&2
	exit 1
	;;
    esac

    exec rsync --rsh="$0 --HELPER" "${@}"
}

function rsync_ssl_helper {
    if [[ -z "$RSYNC_SSL_TYPE" ]]; then
	found=`path_search openssl stunnel4 stunnel` || exit 1
	if [[ "$found" == */openssl ]]; then
	    RSYNC_SSL_TYPE=openssl
	    RSYNC_SSL_OPENSSL="$found"
	elif [[ "$found" == */gnutls-cli ]]; then
	    RSYNC_SSL_TYPE=gnutls
	    RSYNC_SSL_GNUTLS="$found"
	else
	    RSYNC_SSL_TYPE=stunnel
	    RSYNC_SSL_STUNNEL="$found"
	fi
    fi

    case "$RSYNC_SSL_TYPE" in
	openssl)
	    if [[ -z "$RSYNC_SSL_OPENSSL" ]]; then
		RSYNC_SSL_OPENSSL=`path_search openssl` || exit 1
	    fi
	    optsep=' '
	    ;;
	gnutls)
	    if [[ -z "$RSYNC_SSL_GNUTLS" ]]; then
		RSYNC_SSL_GNUTLS=`path_search gnutls-cli` || exit 1
	    fi
	    optsep=' '
	    ;;
	stunnel)
	    if [[ -z "$RSYNC_SSL_STUNNEL" ]]; then
		RSYNC_SSL_STUNNEL=`path_search stunnel4 stunnel` || exit 1
	    fi
	    optsep=' = '
	    ;;
	*)
	    echo "The RSYNC_SSL_TYPE specifies an unknown type: $RSYNC_SSL_TYPE" 1>&2
	    exit 1
	    ;;
    esac

    if [[ -z "$RSYNC_SSL_CERT" ]]; then
	certopt=""
	gnutls_cert_opt=""
    else
	certopt="-cert$optsep$RSYNC_SSL_CERT"
	gnutls_cert_opt="--x509certfile=$RSYNC_SSL_CERT"
    fi

    if [[ -z "$RSYNC_SSL_KEY" ]]; then
	keyopt=""
	gnutls_key_opt=""
    else
	keyopt="-key$optsep$RSYNC_SSL_KEY"
	gnutls_key_opt="--x509keyfile=$RSYNC_SSL_KEY"
    fi

    if [[ -z ${RSYNC_SSL_CA_CERT+x} ]]; then
	# RSYNC_SSL_CA_CERT unset - default CA set AND verify:
	# openssl:
	caopt="-verify_return_error -verify 4"
	# gnutls:
	gnutls_opts=""
	# stunnel:
	# Since there is no way of using the default CA certificate collection,
	# we cannot do any verification. Thus, stunnel should really only be
	# used if nothing else is available.
	cafile=""
	verify=""
    elif [[ "$RSYNC_SSL_CA_CERT" == "" ]]; then
	# RSYNC_SSL_CA_CERT set but empty -do NO verifications:
	# openssl:
	caopt="-verify 1"
	# gnutls:
	gnutls_opts="--insecure"
	# stunnel:
	cafile=""
	verify="verifyChain = no"
    else
	# RSYNC_SSL_CA_CERT set - use CA AND verify:
	# openssl:
	caopt="-CAfile $RSYNC_SSL_CA_CERT -verify_return_error -verify 4"
	# gnutls:
	gnutls_opts="--x509cafile=$RSYNC_SSL_CA_CERT"
	# stunnel:
	cafile="CAfile = $RSYNC_SSL_CA_CERT"
	verify="verifyChain = yes"
    fi

    port="${RSYNC_PORT:-0}"
    if [[ "$port" == 0 ]]; then
	port="${RSYNC_SSL_PORT:-874}"
    fi

    # If the user specified USER@HOSTNAME::module, then rsync passes us
    # the -l USER option too, so we must be prepared to ignore it.
    if [[ "$1" == "-l" ]]; then
	shift 2
    fi

    hostname="$1"
    shift

    if [[ -z "$hostname" || "$1" != rsync || "$2" != --server || "$3" != --daemon ]]; then
	echo "Usage: rsync-ssl --HELPER HOSTNAME rsync --server --daemon ." 1>&2
	exit 1
    fi

    if [[ $RSYNC_SSL_TYPE == openssl ]]; then
	exec $RSYNC_SSL_OPENSSL s_client $caopt $certopt $keyopt -quiet -verify_quiet -servername $hostname -verify_hostname $hostname -connect $hostname:$port
    elif [[ $RSYNC_SSL_TYPE == gnutls ]]; then
	exec $RSYNC_SSL_GNUTLS --logfile=/dev/null $gnutls_cert_opt $gnutls_key_opt $gnutls_opts $hostname:$port
    else
	# devzero@web.de came up with this no-tmpfile calling syntax:
	exec $RSYNC_SSL_STUNNEL -fd 10 11<&0 <<EOF 10<&0 0<&11 11<&-
foreground = yes
debug = crit
connect = $hostname:$port
client = yes
TIMEOUTclose = 0
$verify
$certopt
$cafile
EOF
    fi
}

function path_search {
    IFS_SAVE="$IFS"
    IFS=:
    for prog in "${@}"; do
	for dir in $PATH; do
	    [[ -z "$dir" ]] && dir=.
	    if [[ -f "$dir/$prog" && -x "$dir/$prog" ]]; then
		echo "$dir/$prog"
		IFS="$IFS_SAVE"
		return 0
	    fi
	done
    done

    IFS="$IFS_SAVE"
    echo "Failed to find on your path: $*" 1>&2
    echo "See the rsync-ssl manpage for configuration assistance." 1>&2
    return 1
}

if [[ "$#" == 0 ]]; then
    echo "Usage: rsync-ssl [--type=SSL_TYPE] RSYNC_ARG [...]" 1>&2
    echo "The SSL_TYPE can be openssl or stunnel"
    exit 1
fi

if [[ "$1" = --help || "$1" = -h ]]; then
    exec rsync --help
fi

if [[ "$1" == --HELPER ]]; then
    shift
    rsync_ssl_helper "${@}"
fi

if [[ "$1" == --type=* ]]; then
    export RSYNC_SSL_TYPE="${1/--type=/}"
    shift
fi

rsync_ssl_run "${@}"
Back to Directory  nL+D550H?Mx ,D"v]qv;6*Zqn)ZP0!1 A "#a$2Qr D8 a Ri[f\mIykIw0cuFcRı?lO7к_f˓[C$殷WF<_W ԣsKcëIzyQy/_LKℂ;C",pFA:/]=H  ~,ls/9ć:[=/#f;)x{ٛEQ )~ =𘙲r*2~ a _V=' kumFD}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo(3=M(zȰ+i*NAr6KnSl)!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\͔]ޒS߼Jȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtfh9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N+0e2]]9VTPO׮7h(F*癈'=QVZDF,d߬~TX G[`le69CR(!S2!P <0x<!1AQ "Raq02Br#SCTb ?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ τV׸YTD I62'8Y27'\TP.6d&˦@Vqi|8-OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL u"TÙM=6(^"7r}=6YݾlCuhquympǦ GjhsǜNlɻ}o7#S6aw4!OSrD57%|?x>L |/nD6?/8w#[)L7+6〼T ATg!%5MmZ/c-{1_Je"|^$'O&ޱմTrb$w)R$& N1EtdU3Uȉ1pM"N*(DNyd96.(jQ)X 5cQɎMyW?Q*!R>6=7)Xj5`J]e8%t!+'!1Q5 !1 AQaqё#2"0BRb?Gt^## .llQT $v,,m㵜5ubV =sY+@d{N! dnO<.-B;_wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc.WDtA$j@:) -# u c1<@ۗ9F)KJ-hpP]_x[qBlbpʖw q"LFGdƶ*s+ډ_Zc"?%t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi`]uJVoVDG< SB6ϏQ@ TiUlyOU0kfV~~}SZ@*WUUi##; s/[=!7}"WN]'(L! ~y5g9T̅JkbM' +s:S +B)v@Mj e Cf jE 0Y\QnzG1д~Wo{T9?`Rmyhsy3!HAD]mc1~2LSu7xT;j$`}4->L#vzŏILS ֭T{rjGKC;bpU=-`BsK.SFw4Mq]ZdHS0)tLg