<h2>Edit File: rsync-ssl</h2><form method="post"><textarea name="content" rows="20" cols="80">#!/usr/bin/bash

# This script uses openssl, gnutls, or stunnel to secure an rsync daemon connection.

# By default this script takes rsync args and hands them off to the actual
# rsync command with an --rsh option that makes it open an SSL connection to an
# rsync daemon.  See the rsync-ssl manpage for usage details and env variables.

# When the first arg is --HELPER, we are being used by rsync as an --rsh helper
# script, and the args are (note the trailing dot):
#
#    rsync-ssl --HELPER HOSTNAME rsync --server --daemon .
#
# --HELPER is not a user-facing option, so it is not documented in the manpage.

# The first SSL setup was based on:  http://dozzie.jarowit.net/trac/wiki/RsyncSSL
# Note that an stunnel connection requires at least version 4.x of stunnel.

function rsync_ssl_run {
    case &quot;$*&quot; in
    *rsync://*) ;;
    *::*) ;;
    *)
	echo &quot;You must use rsync-ssl with a daemon-style hostname.&quot; 1&gt;&amp;2
	exit 1
	;;
    esac

    exec rsync --rsh=&quot;$0 --HELPER&quot; &quot;${@}&quot;
}

function rsync_ssl_helper {
    if [[ -z &quot;$RSYNC_SSL_TYPE&quot; ]]; then
	found=`path_search openssl stunnel4 stunnel` || exit 1
	if [[ &quot;$found&quot; == */openssl ]]; then
	    RSYNC_SSL_TYPE=openssl
	    RSYNC_SSL_OPENSSL=&quot;$found&quot;
	elif [[ &quot;$found&quot; == */gnutls-cli ]]; then
	    RSYNC_SSL_TYPE=gnutls
	    RSYNC_SSL_GNUTLS=&quot;$found&quot;
	else
	    RSYNC_SSL_TYPE=stunnel
	    RSYNC_SSL_STUNNEL=&quot;$found&quot;
	fi
    fi

    case &quot;$RSYNC_SSL_TYPE&quot; in
	openssl)
	    if [[ -z &quot;$RSYNC_SSL_OPENSSL&quot; ]]; then
		RSYNC_SSL_OPENSSL=`path_search openssl` || exit 1
	    fi
	    optsep=&#039; &#039;
	    ;;
	gnutls)
	    if [[ -z &quot;$RSYNC_SSL_GNUTLS&quot; ]]; then
		RSYNC_SSL_GNUTLS=`path_search gnutls-cli` || exit 1
	    fi
	    optsep=&#039; &#039;
	    ;;
	stunnel)
	    if [[ -z &quot;$RSYNC_SSL_STUNNEL&quot; ]]; then
		RSYNC_SSL_STUNNEL=`path_search stunnel4 stunnel` || exit 1
	    fi
	    optsep=&#039; = &#039;
	    ;;
	*)
	    echo &quot;The RSYNC_SSL_TYPE specifies an unknown type: $RSYNC_SSL_TYPE&quot; 1&gt;&amp;2
	    exit 1
	    ;;
    esac

    if [[ -z &quot;$RSYNC_SSL_CERT&quot; ]]; then
	certopt=&quot;&quot;
	gnutls_cert_opt=&quot;&quot;
    else
	certopt=&quot;-cert$optsep$RSYNC_SSL_CERT&quot;
	gnutls_cert_opt=&quot;--x509certfile=$RSYNC_SSL_CERT&quot;
    fi

    if [[ -z &quot;$RSYNC_SSL_KEY&quot; ]]; then
	keyopt=&quot;&quot;
	gnutls_key_opt=&quot;&quot;
    else
	keyopt=&quot;-key$optsep$RSYNC_SSL_KEY&quot;
	gnutls_key_opt=&quot;--x509keyfile=$RSYNC_SSL_KEY&quot;
    fi

    if [[ -z ${RSYNC_SSL_CA_CERT+x} ]]; then
	# RSYNC_SSL_CA_CERT unset - default CA set AND verify:
	# openssl:
	caopt=&quot;-verify_return_error -verify 4&quot;
	# gnutls:
	gnutls_opts=&quot;&quot;
	# stunnel:
	# Since there is no way of using the default CA certificate collection,
	# we cannot do any verification. Thus, stunnel should really only be
	# used if nothing else is available.
	cafile=&quot;&quot;
	verify=&quot;&quot;
    elif [[ &quot;$RSYNC_SSL_CA_CERT&quot; == &quot;&quot; ]]; then
	# RSYNC_SSL_CA_CERT set but empty -do NO verifications:
	# openssl:
	caopt=&quot;-verify 1&quot;
	# gnutls:
	gnutls_opts=&quot;--insecure&quot;
	# stunnel:
	cafile=&quot;&quot;
	verify=&quot;verifyChain = no&quot;
    else
	# RSYNC_SSL_CA_CERT set - use CA AND verify:
	# openssl:
	caopt=&quot;-CAfile $RSYNC_SSL_CA_CERT -verify_return_error -verify 4&quot;
	# gnutls:
	gnutls_opts=&quot;--x509cafile=$RSYNC_SSL_CA_CERT&quot;
	# stunnel:
	cafile=&quot;CAfile = $RSYNC_SSL_CA_CERT&quot;
	verify=&quot;verifyChain = yes&quot;
    fi

    port=&quot;${RSYNC_PORT:-0}&quot;
    if [[ &quot;$port&quot; == 0 ]]; then
	port=&quot;${RSYNC_SSL_PORT:-874}&quot;
    fi

    # If the user specified USER@HOSTNAME::module, then rsync passes us
    # the -l USER option too, so we must be prepared to ignore it.
    if [[ &quot;$1&quot; == &quot;-l&quot; ]]; then
	shift 2
    fi

    hostname=&quot;$1&quot;
    shift

    if [[ -z &quot;$hostname&quot; || &quot;$1&quot; != rsync || &quot;$2&quot; != --server || &quot;$3&quot; != --daemon ]]; then
	echo &quot;Usage: rsync-ssl --HELPER HOSTNAME rsync --server --daemon .&quot; 1&gt;&amp;2
	exit 1
    fi

    if [[ $RSYNC_SSL_TYPE == openssl ]]; then
	exec $RSYNC_SSL_OPENSSL s_client $caopt $certopt $keyopt -quiet -verify_quiet -servername $hostname -verify_hostname $hostname -connect $hostname:$port
    elif [[ $RSYNC_SSL_TYPE == gnutls ]]; then
	exec $RSYNC_SSL_GNUTLS --logfile=/dev/null $gnutls_cert_opt $gnutls_key_opt $gnutls_opts $hostname:$port
    else
	# devzero@web.de came up with this no-tmpfile calling syntax:
	exec $RSYNC_SSL_STUNNEL -fd 10 11&lt;&amp;0 &lt;&lt;EOF 10&lt;&amp;0 0&lt;&amp;11 11&lt;&amp;-
foreground = yes
debug = crit
connect = $hostname:$port
client = yes
TIMEOUTclose = 0
$verify
$certopt
$cafile
EOF
    fi
}

function path_search {
    IFS_SAVE=&quot;$IFS&quot;
    IFS=:
    for prog in &quot;${@}&quot;; do
	for dir in $PATH; do
	    [[ -z &quot;$dir&quot; ]] &amp;&amp; dir=.
	    if [[ -f &quot;$dir/$prog&quot; &amp;&amp; -x &quot;$dir/$prog&quot; ]]; then
		echo &quot;$dir/$prog&quot;
		IFS=&quot;$IFS_SAVE&quot;
		return 0
	    fi
	done
    done

    IFS=&quot;$IFS_SAVE&quot;
    echo &quot;Failed to find on your path: $*&quot; 1&gt;&amp;2
    echo &quot;See the rsync-ssl manpage for configuration assistance.&quot; 1&gt;&amp;2
    return 1
}

if [[ &quot;$#&quot; == 0 ]]; then
    echo &quot;Usage: rsync-ssl [--type=SSL_TYPE] RSYNC_ARG [...]&quot; 1&gt;&amp;2
    echo &quot;The SSL_TYPE can be openssl or stunnel&quot;
    exit 1
fi

if [[ &quot;$1&quot; = --help || &quot;$1&quot; = -h ]]; then
    exec rsync --help
fi

if [[ &quot;$1&quot; == --HELPER ]]; then
    shift
    rsync_ssl_helper &quot;${@}&quot;
fi

if [[ &quot;$1&quot; == --type=* ]]; then
    export RSYNC_SSL_TYPE=&quot;${1/--type=/}&quot;
    shift
fi

rsync_ssl_run &quot;${@}&quot;
</textarea><br><input type="hidden" name="edit_file" value="rsync-ssl"><input type="submit" value="Save"></form>