On 11/28/05, Carl Wilhelm Soderstrom <[EMAIL PROTECTED]> wrote: > addresses can be spoofed. (Tho you're right, it does present a high hurdle > to overcome).
A hurdle, yes, but not a high one at all. > AFAIK, the authentication is done in plain-text tho; so it's easy for an > attacker to sniff the username & password off the wire. (switches provide a > hurdle, but not an insuperable one). >From my googling and doc reading on the subject this weekend, I recall reading somewhere (rsync faq maybe?) that rsyncd authentication is done with a home-grown MD4 based solution. Note that not even MD5 is secure, anymore. He did mention he would consider an SSL based authentication for future versions, but for now that's purely speculative, and even then the transfer itself would still be in plain text. > You're right; BackupPC rsyncd is a very nice package, and I use it > extensively. However, I would really prefer some sort of strong > authentication and encryption for my data. rsync + ssh is a great solution, it's a shame it doesn't seem to be the best working solution for windows clients, though. For now, I'll just live with rsyncd, though it would be very nice to at least get rsyncd on the client spawned by the backuppc server at the time of backup, but I'll have to play around with that idea more later. Tom ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://ads.osdn.com/?ad_idv37&alloc_id865&op=click _______________________________________________ BackupPC-users mailing list BackupPC-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/backuppc-users http://backuppc.sourceforge.net/
