Jérôme Warnier wrote:

When installing package rsync on NCP3.0a3, rsync service is started. This is not the default behavior on Debian/Ubuntu as the package ships the client and the daemon together (actually the same binary, but can be started as a service). Using rsync is quite common on NCP, and as it might be a security breach, I recommend disabling it (the SMF service) by default.

rsyncd.conf setup by default after installation has nothing in it.. so no directories are exposed.

~Anil

Anil Gulecha wrote:

Jérôme Warnier wrote:

When installing package rsync on NCP3.0a3, rsync service is started. This is not the default behavior on Debian/Ubuntu as the package ships the client and the daemon together (actually the same binary, but can be started as a service). Using rsync is quite common on NCP, and as it might be a security breach, I recommend disabling it (the SMF service) by default.

rsyncd.conf setup by default after installation has nothing in it.. so no directories are exposed.

~Anil

There are two possible usage of rsync as a server: as a daemon (like in this case) or from inetd (which is also replaced by SMF in OpenSolaris). I wonder if the provided rsyncd.conf does not even prevent from using it from "inetd". In any case, it is not a clean behaviour to enable the daemon by default, because user installing the package is not aware the daemon started (and listens to its port). root@srv:/# apt-get install rsync Reading package lists... Done Building dependency tree
Reading state information... Done Suggested packages: openssh-client openssh-server The following NEW packages will be installed: rsync 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. Need to get 449kB of archives. After this operation, 20.5kB of additional disk space will be used. Get:1 http://apt.nexenta.org hardy-unstable/main rsync 3.0.3-1nexenta1 [449kB] Fetched 449kB in 2s (196kB/s) Selecting previously deselected package rsync. (Reading database ... 30443 files and directories currently installed.) Unpacking rsync (from .../rsync3.0.3-1nexenta1solaris-i386.deb) ... Setting up rsync (3.0.3-1nexenta1) ... root@srv:/# ps auxw|grep [r]sync root 1562 0.0 0.1 3768 1916 ? S 10:23:12 0:00 /usr/bin/rsync --no-detach --daemon --config /etc/rsyncd.conf

We shouldn't ship rsync with default installation.

Dmitry Yusupov wrote:

We shouldn't ship rsync with default installation. It isn't shipped by default on NCP, but it is very common to use it, so please actually fix this bug.

svcadm diable rsync added to postinst. Package will be available in Alpha5 repo.