Re: Trying to elevate rsync privileges when connecting over ssh without using NOPASSWD in sudoers

Why not rsync directly as root?  Then you can use a passwordless,
passphraseless RSA (or similar) keypair.

On Fri, Mar 11, 2022 at 4:58 AM Dr. Mark Asbach via rsync <
[email protected]> wrote:

> Hi there,
>
> We are using ansible to deploy system configuration and web application
> source code to clusters of Linux computers. One part of this process
> requires transferring large directories to the target hosts, which is done
> using the „synchronize“ command in ansible that is in turn a wrapper around
> rsync. This work great in most scenarios, but we run into an issue with a
> specific (albeit for us: prominent) use case:
>
> - We try to have rsync connect over ssh using a non-privileged user
> account.
> - The account is set up for publickey authentication, so we can use ‚rsync
> -e „ssh -i /home/user/.ssh/some_id“‘.
> - On the target side, we want to escalate privileges for rsync, which we
> try using ‚rsync --rsync-path=„sudo rsync“‘.
>
> This whole scenario works fine, as long as for the ssh account we use for
> logging in, passwordless sudo is set up on the target. For security
> reasons, we do not want to go this route. Instead, we want to supply the
> user’s password for gaining privileges. On the web, I’ve found to
> suggestions for solving this:
>
> a) Using ssh-askpass, we can use the options -e "ssh -X"
> --rsync-path="sudo -A rsync" (see https://askubuntu.com/a/1167758). The
> problem in our scenario is that using ansible, we run the identical rsync
> command on multiple hosts in parallel (we target about 32 VMs in one go).
> So the person running the script would have to enter the password into 32
> dialogs exactly at the time they pop up.
>
> b) Passing the password to sudo via stdin using --rsync-path "echo
> MYPASSWORD | sudo -S rsync" (see https://askubuntu.com/a/1155897). This
> has the potential security implication that if the calling line is stored
> somewhere in a shell history file of the control host, the password will be
> breached, but there’s a couple of measures we can take so mitigate that.
> However, I fail at getting this to run.
>
> Here’s a sample command that I get out of a patched ansible „synchronize“
> command. I’m trying to connect to a Ubuntu 18.04 VM with the user account
> „mark“ that is in the „sudoers“ group but does not have „NOPASSWD“ set, so
> running „sudo“ for the first time in a session will require to enter the
> password for „mark“ which here is „test“:
>
> rsync --delay-updates -F --compress --delete-after --archive --no-perms
> --no-owner --no-group --rsh='/usr/bin/ssh -S none -i ~/ssh/some_private_key
> -o Port=2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'
> --rsync-path='echo test | sudo -S -u root rsync 2>/dev/null'
> --out-format='<<CHANGED>>%i %n%L' ~/test_source_dir [email protected]:
> /some/test_target_dir
>
> This is what I get:
> > Warning: Permanently added '[127.0.0.1]:2222' (ED25519) to the list of
> known hosts.
> > rsync: connection unexpectedly closed (0 bytes received so far) [sender]
>
> As far as I understand, this could be due to "sudo -S" prompting for the
> password and that prompt interfering with the rsync communications.
> However, I’m out of ideas what I could do to get around that.
>
> Help would be greatly appreciated ;-)
>
> Thanks and greetings from Cologne,
> Mark--
> Please use reply-all for most replies to avoid omitting the mailing list.
> To unsubscribe or change options:
> https://lists.samba.org/mailman/listinfo/rsync
> Before posting, read: http://www.catb.org/~esr/faqs/smart-questions.html
>

-- 
Please use reply-all for most replies to avoid omitting the mailing list.
To unsubscribe or change options: https://lists.samba.org/mailman/listinfo/rsync
Before posting, read: http://www.catb.org/~esr/faqs/smart-questions.html