dashizz

Members
 View Profile  See their activity

  • Posts

    8

  • Joined

  • Last visited

 Content Type 

Posts posted by dashizz

  2. Latest Sync Build: 1.1.70

    in Sync General Discussion

    Posted

    There is Sync new build: 1.0.130

    [..]

    Fixed: access to files outside of sync folder

    Can you please advise on this fix? Upon selecting "Add folder" the webui is still listing '/' vs 'storage_dir'.The daemon is running under the related system user, even went as far as copying the binary to their storage_dir and running it there but no dice.

    Am I mistaken in thinking it's the same chroot issue I previously pointed out?

  4. WebUI chroot option

    in Sync General Discussion

    Posted

    I also tried the following to set the chroot manually per-say but for some reason the directory never lists:

    - unpack user/.sync/webui.zip

    - change:

    webui.js:14: var ROOT_PATH = "/";

    to:

    var ROOT_PATH = "/home/user/btsync";

    jqueryFileTree.js:39: if( o.root == undefined ) o.root = '/';

    to

    if( o.root == undefined ) o.root = '/home/user/btsync';

    - repack webui.zip

    - chattr +ia webui.zip so that restarting the daemon doesn't reset webui.zip

    - restart btsync daemon

    The list simply sits blank, didn't see any console errors/related server log entries. My JS understanding is pretty limited :) Ideas anyone?

  8. WebUI chroot option

    in Sync General Discussion

    Posted

    Hi all,

    I just recently came across BTSync and plan on mass deployment. My main concern is that the "Select Folder" option in the WebUI (Linux) lists everything starting in '/'. Could you possibly have the WebUI chrooted to the "dir" location from the conf or introduce "chroot" as an available option? For example, user 'qwerty' would have something along the following set in the conf:

    "dir" : "/home/btsync/users/qwerty",

    "chroot" : "/home/btsync/users/qwerty",

    Then when user "qwerty" logs into the WebUI, and clicks "Add folder", their home/root path would be chrooted to the above value(s) and not '/' on the box. I'm sure others would like to see the same implemented in a multi-user environment.

    Detrimental common usage scenario:

    The average user will run the btsync daemon under the root account other than start it under a new/other system user. By doing so, the standard btsync user will be able to add otherwise sensitive file/folder locations to it's share via the WebUI - such as shadow hashes, plaintext database configuration files found on the server, etc. This poses a huge security risk for any shared environment as otherwise imposed system restrictions will be easily circumvented.

    I hope you take the chroot option into consideration :)