mirror of
https://github.com/RsyncProject/rsync.git
synced 2026-01-24 23:08:24 -05:00
3249824264
- Make the rsync-ssl default behavior more user friendly. - Install rsync-ssl & rsync-ssl-rsh in the regular install rules. - Add a manpage for rsync-ssl (which is also installed). - Get rid of the rsync-ssl-client package in our spec file.
128 lines
3.1 KiB
Bash
Executable File
128 lines
3.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# This must be called as (note the trailing dot):
|
|
#
|
|
# rsync-ssl-rsh HOSTNAME rsync --server --daemon .
|
|
#
|
|
# ... which is typically done via the rsync-ssl script, which results in something like this:
|
|
#
|
|
# rsync --rsh=rsync-ssl-rsh -aiv HOSTNAME::module [ARGS]
|
|
#
|
|
# This SSL setup based on the files by: http://dozzie.jarowit.net/trac/wiki/RsyncSSL
|
|
# Note that an stunnel connection requires at least version 4.x of stunnel.
|
|
|
|
# The environment can override our defaults using RSYNC_SSL_* variables
|
|
|
|
function path_search {
|
|
IFS_SAVE="$IFS"
|
|
IFS=:
|
|
for prog in "${@}"; do
|
|
for dir in $PATH; do
|
|
[[ -z "$dir" ]] && dir=.
|
|
if [[ -f "$dir/$prog" && -x "$dir/$prog" ]]; then
|
|
echo "$dir/$prog"
|
|
IFS="$IFS_SAVE"
|
|
return 0
|
|
fi
|
|
done
|
|
done
|
|
|
|
IFS="$IFS_SAVE"
|
|
echo "Failed to find on your path: $*" 1>&2
|
|
echo "See the rsync-ssl manpage for configuration assistance." 1>&2
|
|
return 1
|
|
}
|
|
|
|
if [[ -z "$RSYNC_SSL_TYPE" ]]; then
|
|
found=`path_search stunnel4 stunnel openssl` || exit 1
|
|
if [[ "$found" == */openssl ]]; then
|
|
RSYNC_SSL_TYPE=openssl
|
|
RSYNC_SSL_OPENSSL="$found"
|
|
else
|
|
RSYNC_SSL_TYPE=stunnel
|
|
RSYNC_SSL_STUNNEL="$found"
|
|
fi
|
|
fi
|
|
|
|
case "$RSYNC_SSL_TYPE" in
|
|
openssl)
|
|
if [[ -z "$RSYNC_SSL_OPENSSL" ]]; then
|
|
RSYNC_SSL_OPENSSL=`path_search openssl` || exit 1
|
|
fi
|
|
optsep=' '
|
|
;;
|
|
stunnel)
|
|
if [[ -z "$RSYNC_SSL_STUNNEL" ]]; then
|
|
RSYNC_SSL_STUNNEL=`path_search stunnel4 stunnel` || exit 1
|
|
fi
|
|
optsep=' = '
|
|
;;
|
|
*)
|
|
echo "The RSYNC_SSL_TYPE specifies an unknown type: $RSYNC_SSL_TYPE" 1>&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
if [[ -z "$RSYNC_SSL_CERT" ]]; then
|
|
certopt=""
|
|
else
|
|
certopt="cert$optsep$RSYNC_SSL_CERT"
|
|
fi
|
|
|
|
if [[ -z ${RSYNC_SSL_CA_CERT+x} ]]; then
|
|
# RSYNC_SSL_CA_CERT unset - default CA set AND verify:
|
|
# openssl:
|
|
caopt="-verify_return_error -verify 4"
|
|
# stunnel:
|
|
cafile=""
|
|
verify=0
|
|
elif [[ "$RSYNC_SSL_CA_CERT" == "" ]]; then
|
|
# RSYNC_SSL_CA_CERT set but empty -do NO verifications:
|
|
# openssl:
|
|
caopt="-verify 1"
|
|
# stunnel:
|
|
cafile=""
|
|
verify=0
|
|
else
|
|
# RSYNC_SSL_CA_CERT set - use CA AND verify:
|
|
# openssl:
|
|
caopt="-CAfile $RSYNC_SSL_CA_CERT -verify_return_error -verify 4"
|
|
# stunnel:
|
|
cafile="CAfile = $RSYNC_SSL_CA_CERT"
|
|
verify=3
|
|
fi
|
|
|
|
port="${RSYNC_PORT:-0}"
|
|
if [[ "$port" == 0 ]]; then
|
|
port="${RSYNC_SSL_PORT:-874}"
|
|
fi
|
|
|
|
# If the user specified USER@HOSTNAME::module, then rsync passes us
|
|
# the -l USER option too, so we must be prepared to ignore it.
|
|
if [[ "$1" == "-l" ]]; then
|
|
shift 2
|
|
fi
|
|
|
|
hostname="$1"
|
|
shift
|
|
|
|
if [[ -z "$hostname" || "$1" != rsync || "$2" != --server || "$3" != --daemon ]]; then
|
|
echo "Usage: rsync-ssl-helper HOSTNAME rsync --server --daemon ." 1>&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ $RSYNC_SSL_TYPE == openssl ]]; then
|
|
exec $RSYNC_SSL_OPENSSL s_client $caopt $certopt -quiet -verify_quiet -servername $hostname -connect $hostname:$port
|
|
else
|
|
# devzero@web.de came up with this no-tmpfile calling syntax:
|
|
exec $RSYNC_SSL_STUNNEL -fd 10 11<&0 <<EOF 10<&0 0<&11 11<&-
|
|
foreground = yes
|
|
debug = crit
|
|
connect = $hostname:$port
|
|
client = yes
|
|
TIMEOUTclose = 0
|
|
verify = $verify
|
|
$certopt
|
|
$cafile
|
|
EOF
|
|
fi
|