Secure your rsync shares
blog.steve.org.uk
blog.steve.org.uk
I could certainly see patterns in the things that were exposed. A lot of hosts exposed either:
* A single share called "squid".
* A pair of shares called "sql" & "www". That made me think of a control-panel of some kind.
So someone has gone out of their way to set up insecure rsync daemons.
I wonder if all of these open rsync daemons is due to a poorly configured appliances like a NAS or some other "turn-key" vendor supplied kit. But even then it is a strange thing to enable insecurely...
I don't see how this exposes liability for you—is Google liable when people leave their printer's/router's/fax's/whatever's web configuration interfaces on the public internet with no password? I don't believe they are, and I've seen a number of Google searches in the past on the Hacker News front page linking to pages and pages of them.
However, like Google, you probably want to have a quick way for people to remove their site from the index once they've discovered and secured it.
I, for one, would love to see a search engine of public rsync servers.
(I do own the rsync.io domain, so I have the perfect place to host it ..)
What would likely be best is contacting the owners (of possible). Have a 90 day period where you aren't listed but alerted privately. Then if noncompliance is maintained you to public.
You can't map to that to an individual, unless you mail "abuse@isp" and hope they pass along the message.
The alternative is to download all the private data, looking for email addresses and hoping for the best - i.e. They don't send a mail to "abuse@fbi.gov" about a hacker stealing their data and similar.
Both intent and context come into it heavily. If the majority of rsync shares contain private data, such that your search engine is effectively a private data search engine and can't really be used for anything else without continuously stumbling across more private data, then it could easily be considered radically different from Google's situation.
That may be true in practice, but that's what the law is supposed to be -- an unambiguous social signaling system, that applies to all persons equally, without vagueness or the possibility of terminological confusion.
If a given law can be shown to be vague or confusing, it can be declared unconstitutional. Whether it will be declared unconstitutional depends on whether anyone is willing to fight about it in court.
But the principle of public law is -- yes! -- that it is an "algorithm that can be applied to tell you whether something is legal or not." A failure in this role represents a failure in the legal system itself.
> Both intent and context come into it heavily.
Absolutely false. Someone who breaks the law can't argue that their intent or the context makes any difference. That might affect the punishment, but it doesn't affect the question of guilt.
How would you explain the difference between murder and manslaughter then? If someone dies on the operating table because the surgeon accidentally nicks an artery that's different from them actively trying to kill someone. The act is identical, only the intent is different.
Intent is, and should be, a deciding factor in whether or not someone is guilty of a crime.
Circumstances, which can only affect the punishment, not the judgment that a crime has taken place. But I already said this.
> If someone dies on the operating table because the surgeon accidentally nicks an artery that's different from them actively trying to kill someone. The act is identical, only the intent is different.
In one case, there was a crime, in the other there wasn't.
> Circumstances, which can only affect the punishment, not the judgment that a crime has taken place. But I already said this.
The circumstances which change the crime committed. Not just punishment.
So I was being naive and you are right. And George Orwell was right.
Thinking about murdering someone and not taking any action to that effect, then actually killing that person; VS taking action to do it, strike me as different.
It's possible that they are legally the same, but I doubt the court can do much to prove thought without a confession.
IANAL
True, but it's to some extent splitting hairs, because intent is often (but not always) constructed from thoughts.
> Thinking about murdering someone and not taking any action to that effect, then actually killing that person; VS taking action to do it, strike me as different.
Most courtroom battles on these issues revolve around trying to reconstruct intent based on things that actually happened and that can be presented as testimony. Premeditation, for example -- the difference between degrees of murder in many states -- might be inferred by a person's actions leading up to a crime, and afterward.
> It's possible that they are legally the same, but I doubt the court can do much to prove thought without a confession.
It's commonplace for prosecutions to proceed on the basis of a record of actions that are used to infer thoughts and intents.
By the way, have you heard of "hate crimes"? Those are a real thing, according to the law, anyway.
Huh? The law takes intent into account all the time. (Criminal Defamation, for example).
He would be liable for exposing private data, because of the kind of data he found wouldn't be reasonably published.
Prosecutorial discretion is tricky enough to begin with. But also mix in disregarding intent, and season with charging people multiple times for the same act? Federal prosecutors can be little Putins.
>Absolutely false.
seriously? I thought most laws literally have "intent" as a requirement written into them.
With the OP's service dedicated to explicitly revealing unintentionally insecure rsync servers, I can only imagine the plethora of horrid cyber security laws he would be vulnerable to.
Practically, it depends on where you live. In major urban areas: no they're gone and they probably aren't coming back. Insurance might replace some of them.
In the sticks? Most people don't lock their doors, even if they shut them.
> I know bringing things from the real world into the digital realm often results in badly overstretched metaphors.
Except this metaphor is already stretched beyond breaking. An index isn't even a copy.
Copying a set of publicly available read-only files is not theft (you still have your copy I haven't deprived you of it).
But we're not even talking about copying your files, just the names you've assigned to them. And in his proposed form, even allowing you to remove the names from our index.
Pretty kind treatment for a copy that you've given me when I asked for it.
oh god this again
Edit: it's even stronger in this case, because it's your own equipment that is providing the data to anyone who asks politely (using industry-standard requests and no impersonation or other fraud).
So no, I don't think trespassing is necessarily still trespassing, even if you leave the front door open. Like most things in life, it depends on context.
The expectation and the norm of this situation is that data published on public ports is for public consumption. You can't blame someone for accessing data that you put out there in a public manner, even unintentionally.
Is The Pirate Bay liable when people upload copyright-infringing torrents?
Arguably not, but that's not quite how the law sees it.
There is a minor difference in that people upload to TPB and Google spiders out for content but that doesn't seem relevant here.
netstat -tnlp | grep -v 127.0.0 | grep -v ::1:
Internal and external nmap sweeps: always a good idea*
*If you don't own the network, get permission first.
Use -t to avoid listing local sockets.
So -pltn not -plan
So you still need to check after the install.
lsof -n | grep LISTEN ss -lnpI'd like to set one up, but I know close to nothing of how it works.
But in short you either need to restricted access by IP, configure a password, or disable the daemon and run rsync via SSH which avoids the problem entirely.
So it isn't quite as bad as it might immediately appear...
[foo]
path = /srv/foo
hosts allow 1.2.3.4, 10.20.30.0/24