jaunty rdiff-backup can't use --test-server with a "rdiff-backup --server --restrict" command-locked remote side

[Nick Moffitt]

Binary package hint: rdiff-backup

I have a backup system that uses rdiff-backup. I first test my connection to the server before firing off a backup. I also use ssh command-limited keys to restrict access to /srv/backups/first.last. Starting in Jaunty (this did not happen in any of the releases between Gutsy and Intrepid) the two things appear to clash, as follows:

Testing server started by: ssh -i /var/lib/backups/sshid -C <email address hidden> rdiff-backup --server
Server tests failed
Exception '
Warning Security Violation!
Request to handle path .
which doesn't appear to be within restrict path /srv/backups/first.last.
' raised of class '<class 'rdiff_backup.Security.Violation'>':
  File "/var/lib/python-support/python2.6/rdiff_backup/Main.py", line 304, in er
ror_check_Main
    try: Main(arglist)
  File "/var/lib/python-support/python2.6/rdiff_backup/Main.py", line 324, in Ma
in
    take_action(rps)
  File "/var/lib/python-support/python2.6/rdiff_backup/Main.py", line 291, in ta
ke_action
    elif action == "test-server": SetConnections.TestConnections()
  File "/var/lib/python-support/python2.6/rdiff_backup/SetConnections.py", line
248, in TestConnections
    for i in range(1, len(Globals.connections)): test_connection(i)
  File "/var/lib/python-support/python2.6/rdiff_backup/SetConnections.py", line
256, in test_connection
    assert type(conn.os.listdir('.')) is list
  File "/var/lib/python-support/python2.6/rdiff_backup/connection.py", line 450,
 in __call__
    return apply(self.connection.reval, (self.name,) + args)
  File "/var/lib/python-support/python2.6/rdiff_backup/connection.py", line 370,
 in reval
    if isinstance(result, Exception): raise result

Traceback (most recent call last):
  File "/usr/bin/rdiff-backup", line 30, in <module>
    rdiff_backup.Main.error_check_Main(sys.argv[1:])
  File "/var/lib/python-support/python2.6/rdiff_backup/Main.py", line 304, in er
ror_check_Main
    try: Main(arglist)
  File "/var/lib/python-support/python2.6/rdiff_backup/Main.py", line 324, in Ma
in
    take_action(rps)
  File "/var/lib/python-support/python2.6/rdiff_backup/Main.py", line 291, in ta
ke_action
    elif action == "test-server": SetConnections.TestConnections()
  File "/var/lib/python-support/python2.6/rdiff_backup/SetConnections.py", line
248, in TestConnections
    for i in range(1, len(Globals.connections)): test_connection(i)
  File "/var/lib/python-support/python2.6/rdiff_backup/SetConnections.py", line
256, in test_connection
    assert type(conn.os.listdir('.')) is list
  File "/var/lib/python-support/python2.6/rdiff_backup/connection.py", line 450,
 in __call__
    return apply(self.connection.reval, (self.name,) + args)
  File "/var/lib/python-support/python2.6/rdiff_backup/connection.py", line 370,
 in reval
    if isinstance(result, Exception): raise result
rdiff_backup.Security.Violation:
Warning Security Violation!
Request to handle path .
which doesn't appear to be within restrict path /srv/backups/first.last.

Fatal Error: Lost connection to the remote system

[Nick Moffitt (nick-moffitt)]

I have tried adding a "cd /srv/backups/first.last &&" to the front of the command-limited key, but the traceback still happens.

[Andreas Olsson (andol)]

Just to avoid any confusion. Can you specify the actual command you use to start the --test-server? Also the ssh command-limited key would be nice.

(Yes, I do have my guesses, but never hurts to be sure.)

[Andreas Olsson (andol)]

Also, runnning Jaunty (and rdiff-backup 1.2.7-1ubuntu1) and both sides?

[Nick Moffitt (nick-moffitt)]

The ksy is limited as:

 command="cd /srv/backups/first.last && rdiff-backup --server --restrict /srv/ backups/first.last",no-port-forwarding,no-X11-forwarding,no-agent-forwarding, no-pty,from="10.45.43.*" ssh-rsa AAAA(etc) foo@bar

The command that runs the test and gets the traceback is:

 rdiff-backup --remote-schema "ssh -i $IDENTITY -C %s rdiff-backup --server" --test-server <email address hidden>::/srv/backups/first.last//home

$IDENTITY is just the path to the key (since I could see no other way to do that without an agent)

The clients are Jaunty, and the server is Hardy with backports of the Jaunty librsync and rdiff-backup packages.

[Nick Moffitt (nick-moffitt)]

the space in that --restrict line above is an artifact of the paste, and not in the authorized_keys file on the server.

[Andreas Olsson (andol)]

I can confirm this problem between two Jaunty system, both running 1.2.7-1ubuntu1.

[Andrew Ferguson (adferguson)]

Acknowledging as bug in rdiff-backup. This bug only affects the --test-server option, and is an unintended consequence of a bug fix in 1.2.6. I'll get working on a fix.

[Andrew Ferguson (adferguson)]

Fixed in CVS. Will be included in next rdiff-backup releases, 1.2.8 and 1.3.4.

[Andrew Ferguson (adferguson)]

whoops, I meant 1.2.9 there. sorry for the spam.

[Nick Moffitt (nick-moffitt)]

Can we get this fix rolled into the Jaunty package of 1.2.7? It is actively interfering with a production backup system.

[Nick Moffitt (nick-moffitt)]

I filed this bug against the package of rdiff-backup that is in Jaunty. Has your fix been committed to the Jaunty package, or to upstream source trees? If the latter, could this bug be amended to reflect the fact that it is still very broken in Jaunty?

[Andreas Olsson (andol)]

@Nick: The status "Fix commited" was set by Andrew Ferguson, in regard to the actual rdiff-backup CVS.

@Andrew: The status of "rdiff-backup (Ubuntu)" is meant to describe the status of rdiff-backup in Ubuntu specifically. If possible, this kind of bug tracking works best if there are separate lines regarding the upstream project and the Ubuntu package. See bug #333620 for exampel.

I'll see what I can do in this case.

[Andrew Ferguson (adferguson)]

Oh, I see. I'll try to remember to only set it for the "rdiff-backup" line and not the "rdiff-backup (Ubuntu)" line.

If you want to backport the fix to your package, here's the patch:
http://lists.nongnu.org/archive/html/rdiff-backup-commits/2009-03/msg00023.html

I can't say when the next release of rdiff-backup will be. It partly depends on whether the 'bad index order' bug which has recently been discussed on the mailing list looks like something I can tackle in a short timeframe.

[Nick Moffitt (nick-moffitt)]

Many thanks to the both of you!

Andreas, do you think it would be possible to apply this fix to Jaunty's 1.2.7 package?

[Andreas Olsson (andol)]

@Andrew: thanks!

@Nick: I'll see what I can do.

[Andreas Olsson (andol)]

Can't seem to get it right. I've used these two patches, taken from the provided commit message.

http://cvs.savannah.gnu.org/viewvc/rdiff-backup/rdiff_backup/Main.py?r1=1.127.2.2&r2=1.127.2.3&pathrev=r1-2&root=rdiff-backup&view=patch
http://cvs.savannah.gnu.org/viewvc/rdiff-backup/rdiff_backup/SetConnections.py?r1=1.18.2.2&r2=1.18.2.3&pathrev=r1-2&root=rdiff-backup&view=patch

They apply nicely, but somehow seems to break --test-server completely. This is what I get

andreas@hawat:~$ rdiff-backup --test-server <email address hidden>::dest
<email address hidden>'s password:
Exception ''module' object has no attribute 'connection'' raised of class '<type 'exceptions.AttributeError'>':
  File "/usr/local/lib/python2.5/site-packages/rdiff_backup/Main.py", line 304, in error_check_Main
    try: Main(arglist)
  File "/usr/local/lib/python2.5/site-packages/rdiff_backup/Main.py", line 324, in Main
    take_action(rps)
  File "/usr/local/lib/python2.5/site-packages/rdiff_backup/Main.py", line 291, in take_action
    elif action == "test-server": SetConnections.TestConnections(rps)
  File "/usr/local/lib/python2.5/site-packages/rdiff_backup/SetConnections.py", line 248, in TestConnections
    assert len(Globals.connection) == len(rpaths) + 1

Traceback (most recent call last):
  File "/usr/local/bin/rdiff-backup", line 30, in <module>
    rdiff_backup.Main.error_check_Main(sys.argv[1:])
  File "/usr/local/lib/python2.5/site-packages/rdiff_backup/Main.py", line 304, in error_check_Main
    try: Main(arglist)
  File "/usr/local/lib/python2.5/site-packages/rdiff_backup/Main.py", line 324, in Main
    take_action(rps)
  File "/usr/local/lib/python2.5/site-packages/rdiff_backup/Main.py", line 291, in take_action
    elif action == "test-server": SetConnections.TestConnections(rps)
  File "/usr/local/lib/python2.5/site-packages/rdiff_backup/SetConnections.py", line 248, in TestConnections
    assert len(Globals.connection) == len(rpaths) + 1
AttributeError: 'module' object has no attribute 'connection'
Fatal Error: Lost connection to the remote system

I've tried the patches on both rdiff-backup 1.2.7 and on rdiff-backup 1.2.8 I've been using the same (patched) version of rdiff-backup on both sides.

[Andrew Ferguson (adferguson)]

Argh, typo. That's what I get for hand-moving patches out of my local tree. :-( Thanks so much for testing!!

In the patch, change:

assert len(Globals.connection) == len(rpaths) + 1

to

assert len(Globals.connections) == len(rpaths) + 1

(connection -> connections)

[Andreas Olsson (andol)]

The patch works much better without the typo :-)

I'm uploading a debdiff which uses dpatch to apply the patch in question. Also, I'm subscribing ubuntu-universe-sponsors.

[Andreas Olsson (andol)]

Forgot to mention dpatch in the changelog. Uploads a new version of the debdiff, which does.

[Nafallo Bjälevik (nafallo)]

rdiff-backup (1.2.7-1ubuntu2) jaunty; urgency=low

  * Makes --restrict and --test-server work together again (LP #349072)
  * Adds dpatch, to handle 01_fix_restricted_test-server_option.dpatch

 -- Andreas Olsson <email address hidden> Wed, 01 Apr 2009 23:51:12 +0200