Re: [PLUG] Malware Webshell Infection. - Advice Needed

[brent saner via plug <plug@lists.phillylinux.org>]

On Mon, Sep 4, 2023 at 11:34 AM Casey Bralla via plug <plug@lists.phillylinux.org> wrote:

(SNIP)

As some have mentioned, I have had a passwordless rsync daemon running on the compromised server.

AAAAAnd there's your problem.

 

  (I have my public key stored in the .ssh/authorized_keys file.)

That's great and all, but the rsync daemon does not use SSH. Whatsoever.

When you do

rsync my/local/path/. someuser@somehost:/some/path/.

It uses an SSH tunnel, and spawns rsync on the remote, and uses that for the file transfer - essentially tunneling the RSYNC protocol over SSH. Which is the "right" way to do this for your use case.

The rsync daemon, on the other hand, uses the RSYNC protocol (rsync://) with no SSH tunneling whatsoever. Because you disabled authentication/authorization in the rsync daemon config, it is indeed wide open to the entire world. (Or whatever the firewall to port 873 allows.) From recollection, you CAN do TLS authentication/authorization/tunneling for rsync --daemon, but you are not doing that here.

Don't run rsyncd/rsync --daemon unless you know what you're doing, why you're doing it, and why you would need it instead of just plain ol' SSH-tunneled RSYNC. You do not need the rsync daemon to run to use RSYNC over SSH whatsoever.

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug