《Linux下rsync服务的深入分析》
rsyncd.conf
rsync的配置文件默认为/etc/rsyncd.conf
配置文件包括全局选项和模块选项.
1)comment(全局/模块)
给模块指定一个描述，该描述连同模块名在客户连接得到模块列表时显示给客户.
测试:
vi /etc/rsyncd.conf
添加如下内容:
[test_rsync]
comment = "test rsync server"
path = /tmp/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
ignore errors = yes
客户端测试:
rsync 10.1.1.21::
test_rsync "test rsync server"
注:我们看到在查看rsync模块时,会在模块名后面列出注释.
2)motd(全局)
指定一个消息文件,当客户连接服务器时该文件的内容显示给客户.
测试:
vi /etc/rsyncd.conf
添加如下内容:
motd file=/etc/motd
客户端测试:
rsync 10.1.1.21::test_rsync
Linux 10.1.1.21 2.6.26-1-xen-amd64 #1 SMP Fri Mar 13 21:39:38 UTC 2009 x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
drwxrwxrwx 36864 2011/08/04 10:57:32 .
-rw-r--r-- 18832 2011/08/04 09:44:58 services
drwxrwxrwt 4096 2011/06/30 18:15:49 .ICE-unix
drwxrwxrwt 4096 2011/06/30 18:15:49 .X11-unix
drwxr-xr-x 4096 2011/07/01 07:10:02 .webmin
3)log file(全局/模块)
指定rsync守护进程的日志文件,而不将日志发送给 syslog.
测试:
vi /etc/rsyncd.conf
添加如下内容:
log file=/var/log/test
客户端测试:
rsync 10.1.1.21::test_rsync
drwxrwxrwx 36864 2011/08/04 11:24:18 .
-rw-r--r-- 18832 2011/08/04 09:44:58 services
drwxrwxrwt 4096 2011/06/30 18:15:49 .ICE-unix
drwxrwxrwt 4096 2011/06/30 18:15:49 .X11-unix
drwxr-xr-x 4096 2011/07/01 07:10:02 .webmin
在服务端查看test文件:
cat /var/log/test
2011/08/04 03:02:59 [12571] rsync on test_rsync/ from UNKNOWN (10.1.6.69)
2011/08/04 03:02:59 [12571] building file list
2011/08/04 03:02:59 [12571] sent 509 bytes received 33 bytes total size 18832
4)address(全局)
在独立运行时,用于指定的服务器运行的IP地址.
测试:
vi /etc/rsyncd.conf
添加如下内容:
address=10.1.1.21
查看绑定IP地址:
netstat -tulnp|grep rsync
tcp 0 0 10.1.1.21:873 0.0.0.0:* LISTEN 12983/rsync
注:已经成功绑定在10.1.1.21的IP地址上.
5)port(全局)
指定rsync守护进程监听的端口号.
测试:
vi /etc/rsyncd.conf
添加如下内容:
port=874
查看其绑定的port端口号:
netstat -tulnp|grep rsync
tcp 0 0 10.1.1.21:874 0.0.0.0:* LISTEN 13076/rsync
6)syslog facility(全局)
指定 rsync 发送日志消息给 syslog 时的消息级别
注意:如果启用该选项就要关闭log file选项,默认情况下log file选项会被启用.
测试:
vi /etc/rsyncd.conf
添加如下内容:
syslog facility=daemon
客户端测试:
rsync 10.1.1.21::test_rsync
查看服务端facility为daemon的日志,如下:
tail -f /var/log/daemon.log
Aug 4 11:41:13 10 rsyncd[13168]: connect from UNKNOWN (10.1.6.69)
Aug 4 11:41:13 10 rsyncd[13168]: rsync on test_rsync/ from UNKNOWN (10.1.6.69)
Aug 4 11:41:13 10 rsyncd[13168]: building file list
Aug 4 11:41:13 10 rsyncd[13168]: sent 144 bytes received 33 bytes total size 18832
7)socket options(全局)
指定自定义 TCP 选项,如下:
socket options=SO_SNDBUF=128000,SO_RCVBUF=128000
测试起来差别不大.
8)path(模块)
指定当前模块在 rsync 服务器上的同步路径,该参数是必须指定的
测试:
vi /etc/rsyncd.conf
添加如下内容:
[test_rsync]
comment = "test rsync server"
path = /tmp/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
客户端测试:
rsync -avpz data 10.1.1.21::test_rsync
sending incremental file list
data
sent 104908847 bytes received 27 bytes 9991321.33 bytes/sec
total size is 104857600 speedup is 1.00
注:path里面的路径可以是软链接.
9)max connections(全局/模块)
指定该模块的最大并发连接数量以保护服务器,超过限制的连接请求将被告知随后再试
注意:如果在全局模式下定义该选项,则对所有的模块都进行限制,例如:全局定义为3,此时客户端建立了三个与模块A的连接,此时其它模块只能等待.
测试:
vi /etc/rsyncd.conf
添加如下内容:
max connections=1
终端1)
rsync -avpLz data 10.1.1.21::test_rsync
终端2)
rsync -avLpz data 10.1.1.21::test_rsync
@ERROR: max connections (1) reached -- try again later
rsync error: error starting client-server protocol (code 5) at main.c(1524) [sender=3.0.7]
注:提示连接数已满.
10)use chroot(全局/模块)
若为 true,则 rsync 在传输文件之前首先 chroot 到 path 参数所指定的目录下.
这样做的原因是实现额外的安全防护,但是缺点是需要 root 权限,并且不能备份指向 path 外部的符号连接所指向的目录文件.
测试:
vi /etc/rsyncd.conf
添加如下内容:
use chroot = no
客户端测试:
rsync -avpzL data data[1-2] 10.1.1.21::test_rsync
sending incremental file list
data
data1
data2
sent 314726513 bytes received 65 bytes 11444602.84 bytes/sec
total size is 314572800 speedup is 1.00
注意:
在客户端同步的过程中我们查看rsync进程的根目录,如下:
ls -l /proc/15701/root
lrwxrwxrwx 1 root root 0 2011-08-04 14:43 /proc/15701/root -> /
我们将use chroot改为yes,如下:
use chroot = yes
客户端测试:
rsync -avpzL data data[1-2] 10.1.1.21::test_rsync
sending incremental file list
data
data1
data2
查看rsync进程的根目录,如下:
ls -l /proc/15619/root
lrwxrwxrwx 1 root root 0 2011-08-04 14:42 /proc/15619/root -> /tmp
注:如果被同步目录中有软链接,如下:
ls -l
total 307532
lrwxrwxrwx 1 root root 5 2011-08-04 14:28 aaa -> /etc/
-rw-r--r-- 1 www-data www-data 104857600 2011-08-04 10:17 data
-rw-r--r-- 1 www-data www-data 104857600 2011-08-04 14:42 data1
-rw-r--r-- 1 www-data www-data 104857600 2011-08-04 14:42 data2
-rw-r--r-- 1 www-data www-data 18832 2011-08-04 09:44 services
此时如果启用chroot,我们将无法同步aaa这个软链接目录,如下:
rsync -avpzL 10.1.1.21::test_rsync .
receiving incremental file list
symlink has no referent: "/aaa" (in test_rsync)
./
sent 38 bytes received 203 bytes 482.00 bytes/sec
total size is 18832 speedup is 78.14
rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1526) [generator=3.0.7]
注意:同步软链接,一定要用-L参数.
11)uid/gid
指定该模块以指定的用户的uid/gid传输文件.
测试:
vi /etc/rsyncd.conf
添加如下内容:
uid = www-data
gid = www-data
客户端测试:
查看文件属主,如下:
ls -l data*
-rw-r--r-- 1 troy troy 104857600 2011-08-04 10:17 data
-rw-r--r-- 1 troy troy 104857600 2011-08-04 14:42 data1
-rw-r--r-- 1 troy troy 104857600 2011-08-04 14:42 data2
同步文件到rsync服务端,如下:
rsync -avpzL data data[1-3] 10.1.1.21::test_rsync
sending incremental file list
data
data1
data2
sent 314726513 bytes received 65 bytes 11043037.82 bytes/sec
total size is 314572800 speedup is 1.00
在服务端查看文件,如下:
ls -l
total 307512
-rw-r--r-- 1 www-data www-data 104857600 2011-08-04 10:17 data
-rw-r--r-- 1 www-data www-data 104857600 2011-08-04 14:42 data1
-rw-r--r-- 1 www-data www-data 104857600 2011-08-04 14:42 data2
注:我们看到同步后的文件owner是www-data.也就是说客户端同步文件到rsync服务端,rsync服务端会根据uid/gid将文件的属主进行修改.
而如果我们将uid/gid改为root,那么rsync不会把同步文件的uid/gid改为root,而会继续保留该UID/GID,原因是root用户可以保留owner的信息.
如下:
在客户端查看troy的uid,这里为1502
grep troy /etc/passwd
troy:x:1502:1502::/home/troy:/bin/bash
查看客户端待同步文件的owner,这里为troy
-rw-r--r-- 1 troy troy 104857600 2011-08-04 10:17 data
-rw-r--r-- 1 troy troy 104857600 2011-08-04 14:42 data1
-rw-r--r-- 1 troy troy 104857600 2011-08-04 14:42 data2
在rsync服务端将uid/gid改为root,如下:
vi /etc/rsyncd.conf
uid = root
gid = root
最后在客户端进行同步,如下:
rsync -avpzL data data[1-2] 10.1.1.21::test_rsync
sending incremental file list
data
data1
data2
sent 314726526 bytes received 65 bytes 10668698.00 bytes/sec
total size is 314572800 speedup is 1.00
查看rsync服务端的权限,如下:
ls -l data*
-rw-r--r-- 1 1502 1502 104857600 2011-08-04 10:17 data
-rw-r--r-- 1 1502 1502 104857600 2011-08-04 14:42 data1
-rw-r--r-- 1 1502 1502 104857600 2011-08-04 14:42 data2
注:我们看到文件不能显示owner的名字,而只是uid,说明如果在rsync文件中uid/gid为root,就会把权限继承过来.
12)list
指定当客户请求列出可以使用的模块列表时,该模块是否应该被列出.如果设置该选项为no,可以创建隐藏的模块.
测试:
vi /etc/rsyncd.conf
添加如下内容:
[test_rsync]
comment = "test rsync server"
path = /tmp/
list = no
use chroot = yes
uid = www-data
gid = www-data
read only = no
客户端同步测试:
rsync 10.1.1.21::
test.61.com
注:我们只看到test.61.com的模块,没看test_rsync模块.
13)read only
指定是否允许客户上传文件,若为 yes 则不允许上传；若为 no 并且服务器目录也具有读写权限则允许上传.
测试:
vi /etc/rsyncd.conf
添加如下内容:
[test_rsync]
comment = "test rsync server"
path = /tmp/
#secrets file = /etc/rsyncd.secrets
list = no
use chroot = yes
uid = root
gid = root
read only = yes
客户端同步测试:
rsync -avLpz data 10.1.1.21::test_rsync
sending incremental file list
ERROR: module is read only
rsync error: syntax or usage error (code 1) at main.c(884) [receiver=3.0.3]
rsync: read error: Connection reset by peer (104)
rsync error: error in rsync protocol data stream (code 12) at io.c(760) [sender=3.0.7]
14)write only
指定是否允许客户下载文件.若为 yes 则不允许下载;若为 no 并且服务器目录也具有读权限则允许下载
测试:
vi /etc/rsyncd.conf
添加内容如下:
[test_rsync]
comment = "test rsync server"
path = /tmp/
list = no
use chroot = yes
uid = root
gid = root
read only = no
write only = yes
客户端同步测试:
rsync -avLpz 10.1.1.21::test_rsync/data .
receiving incremental file list
ERROR: module is write only
rsync error: syntax or usage error (code 1) at main.c(710) [sender=3.0.3]
rsync: connection unexpectedly closed (5 bytes received so far) [Receiver]
rsync error: error in rsync protocol data stream (code 12) at io.c(601) [Receiver=3.0.7]
15)dont compress
用来指定那些在传输之前不进行压缩处理的文件,要防止使用压缩,应该是:”dont compress = *”
实际上该参数没什么作用,即如果客户端用rsync使用-z参数进行压缩,则dont compress无效.
如果不使用-z参数进行压缩,则默认传输是不压缩的.
测试:
vi /etc/rsyncd.conf
添加内容如下:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
timeout = 1
dont compress = *
注:这里我们拒绝所有压缩.
客户端同步测试:
rsync -avLp test --progress 10.1.1.160::website
sending incremental file list
test
1048576000 100% 11.06MB/s 0:01:30 (xfer#1, to-check=0/1)
sent 1048704065 bytes received 27 bytes 11461246.91 bytes/sec
注:采用压缩现在为每秒传输11MB的数据
下面采用压缩方式进行测试:
rsync -avLpz test --progress 10.1.1.160::website
sending incremental file list
test
1048576000 100% 21.88MB/s 0:00:45 (xfer#1, to-check=0/1)
sent 1019739 bytes received 27 bytes 19801.28 bytes/sec
total size is 1048576000 speedup is 1028.25
我们看到压缩后每秒传输21MB左右的数据,而dont compress没有发挥任何作用.
16)exclude
指定多个文件或目录(相对路径)不被同步,并将其添加到 exclude 列表中.多个文件(目录)用空格分隔.
作用等同于在客户端命令中使用--exclude来指定模式.
测试:
vi /etc/rsyncd.conf
添加内容如下:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
exclude = 1 2
这里我们排除文件(目录)1和2
服务端创建测试文件,如下:
touch 1 2 3 4 5 6 7
客户端同步文件,如下:
rsync -avLpz --progress 10.1.1.160::website .
receiving incremental file list
./
3
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=4/6)
4
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=3/6)
5
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=2/6)
6
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=1/6)
7
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=0/6)
sent 127 bytes received 300 bytes 854.00 bytes/sec
total size is 0 speedup is 0.00
注:我们看到没有同步1和2两个文件.
17)include
该选项针对于exclude,即同步exclude中的哪个文件(目录),并将其添加到include列表中.多个文件(目录)用空格分隔.
作用等同于在客户端命令中使用--include来指定模式.
测试:
vi /etc/rsyncd.conf
添加内容如下:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
exclude = 1 2
include = 1
这里我们通过exclude排除1和2两个文件(目录),又通过include包括文件名为1的文件.
客户端测试:
rsync -avLpz --progress 10.1.1.160::website .
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=5/7)
3
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=4/7)
4
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=3/7)
5
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=2/7)
6
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=1/7)
7
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=0/7)
sent 146 bytes received 334 bytes 960.00 bytes/sec
total size is 0 speedup is 0.00
注:这里rsync同步了文件1,这是因为include起了作用,文件2仍然没有被同步.
18)exclude from
作用同exclude一致,只不过是从文件中提取.
测试:
vi /etc/rsyncd.conf
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
exclude from = /tmp/exclude
这里我们通过exclude from选项加载/tmp/exclude文件.
编辑/tmp/exclude文件,如下:
echo -e "1\n2" >> /tmp/exclude
cat /tmp/exclude
1
2
客户端测试:
rsync -avLpz --progress 10.1.1.160::website .
receiving incremental file list
./
3
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=4/6)
4
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=3/6)
5
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=2/6)
6
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=1/6)
7
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=0/6)
sent 127 bytes received 292 bytes 279.33 bytes/sec
total size is 0 speedup is 0.00
我们看到没有同步1和2两个文件.
19)include from
作用同include一致,只不过是从文件中提取.
测试:
vi /etc/rsyncd.conf
添加如下选项:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
exclude from = /tmp/exclude
include from = /tmp/include
编辑include文件,如下:
echo "1" >> /tmp/include
客户端同步:
rsync -avLpz --progress 10.1.1.160::website .
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=5/7)
3
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=4/7)
4
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=3/7)
5
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=2/7)
6
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=1/7)
7
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=0/7)
sent 146 bytes received 334 bytes 960.00 bytes/sec
total size is 0 speedup is 0.00
这里没有同步文件2.
最后要说明的是客户端rsync即使加了include/exclude选项也是不能对服务端的配置产生影响.
例如:服务端有exclude 1 2 3的配置项,客户端同步时使用include 1 2 3,此时文件1 2 3仍然不会被同步下来.
20)auth users与secrets file
这两个选项只能组合使用
auth users指定由空格或逗号分隔的用户名列表,只有这些用户才允许连接该模块,这里的用户和系统用户没有任何关系.
用户名和口令以明文方式存放在 secrets file 参数指定的文件中.
测试:
vi /etc/rsyncd.conf
添加如下选项:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = www-data
secrets file = /etc/rsyncd.secret
echo "test:123456" >> /etc/rsyncd.secret
chmod 400 /etc/rsyncd.secret
客户端同步:
rsync -aLvpz --progress [email protected]::website .
Password:
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=6/8)
2
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=5/8)
3
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=4/8)
4
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=3/8)
5
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=2/8)
6
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=1/8)
7
0 100% 0.00kB/s 0:00:00 (xfer#7, to-check=0/8)
sent 193 bytes received 417 bytes 244.00 bytes/sec
total size is 0 speedup is 0.00
21)strict modes
指定是否监测口令文件的权限.若为 yes 则口令文件只能被 rsync 服务器运行身份的用户访问,其他任何用户不可以访问该文件.
默认为yes,这里我们做一下测试,如下:
vi /etc/rsyncd.conf
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = yes
设置文件/etc/rsyncd.secret为可读可写可执行,如下:
chmod 777 /etc/rsyncd.secret
客户端同步失败,如下:
rsync -aLvpz --progress [email protected]::website .
Password:
@ERROR: auth failed on module website
rsync error: error starting client-server protocol (code 5) at main.c(1524) [Receiver=3.0.7]
更改strict modes为no,如下:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = no
再次测试,如下:
rsync -aLvpz --progress [email protected]::website .
Password:
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=6/8)
2
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=5/8)
3
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=4/8)
4
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=3/8)
5
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=2/8)
6
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=1/8)
7
0 100% 0.00kB/s 0:00:00 (xfer#7, to-check=0/8)
sent 193 bytes received 417 bytes 244.00 bytes/sec
total size is 0 speedup is 0.00
22)hosts allow
用一个主机列表指定哪些主机客户允许连接该模块.不匹配主机列表的主机将被拒绝.
也就是说如果指定hosts allow那么不在hosts allow指定中的主机都将都拒绝.
测试:
vi /etc/rsyncd.conf
添加如下内容:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = yes
hosts allow = 10.1.1.163
这里指定允许10.1.1.163的主机访问该模块.
我们在10.1.1.163同步，如下:
rsync -aLvpz --progress [email protected]::website .
Password:
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=6/8)
2
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=5/8)
3
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=4/8)
4
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=3/8)
5
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=2/8)
6
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=1/8)
7
0 100% 0.00kB/s 0:00:00 (xfer#7, to-check=0/8)
sent 193 bytes received 417 bytes 244.00 bytes/sec
total size is 0 speedup is 0.00
我们在10.1.1.162上同步如下:
rsync -aLvpz --progress [email protected]::website .
@ERROR: access denied to website from unknown (10.1.1.162)
rsync error: error starting client-server protocol (code 5) at main.c(1524) [Receiver=3.0.7]
23)hosts deny
用一个主机列表指定哪些主机不能连接rsync模块.
如果hosts allow和hosts deny同时指定一台主机,则以hosts allow为准.
测试:
vi /etc/rsyncd.conf
添加内容如下:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = yes
hosts deny = 10.1.1.163
在10.1.1.163上测试,如下:
rsync -aLvpz --progress [email protected]::website .
@ERROR: access denied to website from unknown (10.1.1.163)
rsync error: error starting client-server protocol (code 5) at main.c(1524) [Receiver=3.0.7]
在10.1.1.162上测试,如下:
rsync -aLvpz --progress [email protected]::website .
Password:
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=6/8)
2
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=5/8)
3
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=4/8)
4
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=3/8)
5
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=2/8)
6
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=1/8)
7
0 100% 0.00kB/s 0:00:00 (xfer#7, to-check=0/8)
sent 193 bytes received 417 bytes 244.00 bytes/sec
total size is 0 speedup is 0.00
注:10.1.1.163上同步失败,在10.1.1.162上成功同步.
24)transfer logging
该选项开启则记录下载和上载操作.
测试:
vi /etc/rsyncd.conf
添加如下内容:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = yes
transfer logging = yes
客户端测试:
rsync -aLvpz --progress [email protected]::website .
Password:
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=6/8)
2
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=5/8)
3
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=4/8)
4
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=3/8)
5
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=2/8)
6
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=1/8)
7
0 100% 0.00kB/s 0:00:00 (xfer#7, to-check=0/8)
sent 193 bytes received 417 bytes 244.00 bytes/sec
total size is 0 speedup is 0.00
查看rsync服务端日志:
tail -f /var/log/daemon.log
Aug 18 01:13:09 debian rsyncd[18403]: name lookup failed for 10.1.1.162: Name or service not known
Aug 18 01:13:09 debian rsyncd[18403]: connect from UNKNOWN (10.1.1.162)
Aug 18 01:13:10 debian rsyncd[18403]: rsync on website/ from test@unknown (10.1.1.162)
Aug 18 01:13:10 debian rsyncd[18403]: building file list
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 1 0
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 2 0
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 3 0
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 4 0
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 5 0
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 6 0
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 7 0
Aug 18 01:13:10 debian rsyncd[18403]: sent 432 bytes received 194 bytes total size
25)log format
通过该选项用户在使用transfer logging可以自己定制日志文件的字段.
其格式是一个包含格式定义符的字符串,但要注意log format使用要在transfer logging选项开启的时候才可以.
测试:
vi /etc/rsyncd.conf
添加如下内容:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = yes
transfer logging = yes
log format = [op]:%o [ip]:%a [module]:%m [path]:%P [file]:%f [size]:%l
注:
%o表示服务端提供什么操作,比如是接收还是发送.
%a表示客户端的IP地址.
%m表示服务端的模块.
%P表示服务端模块指定的路径.
%f表示同步的文件.
%l表示同步文件的大小.
客户端测试:
rsync -aLvpz --progress [email protected]::website .
Password:
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=6/8)
2
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=5/8)
3
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=4/8)
4
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=3/8)
5
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=2/8)
6
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=1/8)
7
0 100% 0.00kB/s 0:00:00 (xfer#7, to-check=0/8)
sent 193 bytes received 417 bytes 406.67 bytes/sec
total size is 0 speedup is 0.00
查看服务端的rsync日志,如下:
Aug 18 14:46:43 debian rsyncd[18844]: name lookup failed for 10.1.1.162: Name or service not known
Aug 18 14:46:43 debian rsyncd[18844]: connect from UNKNOWN (10.1.1.162)
Aug 18 14:46:44 debian rsyncd[18844]: rsync on website/ from test@unknown (10.1.1.162)
Aug 18 14:46:44 debian rsyncd[18844]: building file list
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:1 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:2 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:3 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:4 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:5 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:6 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:7 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: sent 432 bytes received 194 bytes total size 0
经过上面的分析整理,建议采用的配置如下:
# GLOBAL OPTIONS
################################
#显示系统提示信息
################################
motd file=/etc/motd
################################
#rsync服务绑定地址
################################
address=10.1.1.160
################################
#rsync服务绑定端口
################################
port=873
################################
#指定rsync服务的pid文件和lock文件
################################
pid file=/var/run/rsyncd.pid
lock file = /var/lock/rsyncd
################################
#指定rsync服务的日志文件
################################
log file=/var/log/rsyncd
################################
#记录rsync传输日志
################################
transfer logging = yes
################################
#定制rsync日志格式
################################
log format = [op]:%o [ip]:%a [module]:%m [path]:%P [file]:%f [size]:%l
################################
#指定syslog的facility
################################
syslog facility=daemon
################################
#最多允许5个客户端连接rsync服务器
################################
max connections=5
# MODULE OPTIONS
[website]
################################
#在list中可以显示模块信息
################################
comment = "web server"
################################
#指定同步的路径
################################
path = /var/www/
################################
#允许list该模块
################################
list = yes
################################
#开启chroot选项
################################
use chroot = yes
################################
#同步过程中使用哪个用户的uid/gid
################################
uid = www-data
gid = www-data
################################
#根据需求确认是否只读/只写
################################
read only = no
write only = no
################################
#根据需求确认是否要排除某些文件同步
################################
exclude =
include =
################################
#用户验证,必须提供相关的用户名/密码,且密码文件仅owner为可读可写
################################
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = yes
################################
#只允许指定的IP可以访问rsync服务
################################
hosts allow = 10.1.1.162
hosts deny = *
rsync的配置文件默认为/etc/rsyncd.conf
配置文件包括全局选项和模块选项.
1)comment(全局/模块)
给模块指定一个描述，该描述连同模块名在客户连接得到模块列表时显示给客户.
测试:
vi /etc/rsyncd.conf
添加如下内容:
[test_rsync]
comment = "test rsync server"
path = /tmp/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
ignore errors = yes
客户端测试:
rsync 10.1.1.21::
test_rsync "test rsync server"
注:我们看到在查看rsync模块时,会在模块名后面列出注释.
2)motd(全局)
指定一个消息文件,当客户连接服务器时该文件的内容显示给客户.
测试:
vi /etc/rsyncd.conf
添加如下内容:
motd file=/etc/motd
客户端测试:
rsync 10.1.1.21::test_rsync
Linux 10.1.1.21 2.6.26-1-xen-amd64 #1 SMP Fri Mar 13 21:39:38 UTC 2009 x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
drwxrwxrwx 36864 2011/08/04 10:57:32 .
-rw-r--r-- 18832 2011/08/04 09:44:58 services
drwxrwxrwt 4096 2011/06/30 18:15:49 .ICE-unix
drwxrwxrwt 4096 2011/06/30 18:15:49 .X11-unix
drwxr-xr-x 4096 2011/07/01 07:10:02 .webmin
3)log file(全局/模块)
指定rsync守护进程的日志文件,而不将日志发送给 syslog.
测试:
vi /etc/rsyncd.conf
添加如下内容:
log file=/var/log/test
客户端测试:
rsync 10.1.1.21::test_rsync
drwxrwxrwx 36864 2011/08/04 11:24:18 .
-rw-r--r-- 18832 2011/08/04 09:44:58 services
drwxrwxrwt 4096 2011/06/30 18:15:49 .ICE-unix
drwxrwxrwt 4096 2011/06/30 18:15:49 .X11-unix
drwxr-xr-x 4096 2011/07/01 07:10:02 .webmin
在服务端查看test文件:
cat /var/log/test
2011/08/04 03:02:59 [12571] rsync on test_rsync/ from UNKNOWN (10.1.6.69)
2011/08/04 03:02:59 [12571] building file list
2011/08/04 03:02:59 [12571] sent 509 bytes received 33 bytes total size 18832
4)address(全局)
在独立运行时,用于指定的服务器运行的IP地址.
测试:
vi /etc/rsyncd.conf
添加如下内容:
address=10.1.1.21
查看绑定IP地址:
netstat -tulnp|grep rsync
tcp 0 0 10.1.1.21:873 0.0.0.0:* LISTEN 12983/rsync
注:已经成功绑定在10.1.1.21的IP地址上.
5)port(全局)
指定rsync守护进程监听的端口号.
测试:
vi /etc/rsyncd.conf
添加如下内容:
port=874
查看其绑定的port端口号:
netstat -tulnp|grep rsync
tcp 0 0 10.1.1.21:874 0.0.0.0:* LISTEN 13076/rsync
6)syslog facility(全局)
指定 rsync 发送日志消息给 syslog 时的消息级别
注意:如果启用该选项就要关闭log file选项,默认情况下log file选项会被启用.
测试:
vi /etc/rsyncd.conf
添加如下内容:
syslog facility=daemon
客户端测试:
rsync 10.1.1.21::test_rsync
查看服务端facility为daemon的日志,如下:
tail -f /var/log/daemon.log
Aug 4 11:41:13 10 rsyncd[13168]: connect from UNKNOWN (10.1.6.69)
Aug 4 11:41:13 10 rsyncd[13168]: rsync on test_rsync/ from UNKNOWN (10.1.6.69)
Aug 4 11:41:13 10 rsyncd[13168]: building file list
Aug 4 11:41:13 10 rsyncd[13168]: sent 144 bytes received 33 bytes total size 18832
7)socket options(全局)
指定自定义 TCP 选项,如下:
socket options=SO_SNDBUF=128000,SO_RCVBUF=128000
测试起来差别不大.
8)path(模块)
指定当前模块在 rsync 服务器上的同步路径,该参数是必须指定的
测试:
vi /etc/rsyncd.conf
添加如下内容:
[test_rsync]
comment = "test rsync server"
path = /tmp/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
客户端测试:
rsync -avpz data 10.1.1.21::test_rsync
sending incremental file list
data
sent 104908847 bytes received 27 bytes 9991321.33 bytes/sec
total size is 104857600 speedup is 1.00
注:path里面的路径可以是软链接.
9)max connections(全局/模块)
指定该模块的最大并发连接数量以保护服务器,超过限制的连接请求将被告知随后再试
注意:如果在全局模式下定义该选项,则对所有的模块都进行限制,例如:全局定义为3,此时客户端建立了三个与模块A的连接,此时其它模块只能等待.
测试:
vi /etc/rsyncd.conf
添加如下内容:
max connections=1
终端1)
rsync -avpLz data 10.1.1.21::test_rsync
终端2)
rsync -avLpz data 10.1.1.21::test_rsync
@ERROR: max connections (1) reached -- try again later
rsync error: error starting client-server protocol (code 5) at main.c(1524) [sender=3.0.7]
注:提示连接数已满.
10)use chroot(全局/模块)
若为 true,则 rsync 在传输文件之前首先 chroot 到 path 参数所指定的目录下.
这样做的原因是实现额外的安全防护,但是缺点是需要 root 权限,并且不能备份指向 path 外部的符号连接所指向的目录文件.
测试:
vi /etc/rsyncd.conf
添加如下内容:
use chroot = no
客户端测试:
rsync -avpzL data data[1-2] 10.1.1.21::test_rsync
sending incremental file list
data
data1
data2
sent 314726513 bytes received 65 bytes 11444602.84 bytes/sec
total size is 314572800 speedup is 1.00
注意:
在客户端同步的过程中我们查看rsync进程的根目录,如下:
ls -l /proc/15701/root
lrwxrwxrwx 1 root root 0 2011-08-04 14:43 /proc/15701/root -> /
我们将use chroot改为yes,如下:
use chroot = yes
客户端测试:
rsync -avpzL data data[1-2] 10.1.1.21::test_rsync
sending incremental file list
data
data1
data2
查看rsync进程的根目录,如下:
ls -l /proc/15619/root
lrwxrwxrwx 1 root root 0 2011-08-04 14:42 /proc/15619/root -> /tmp
注:如果被同步目录中有软链接,如下:
ls -l
total 307532
lrwxrwxrwx 1 root root 5 2011-08-04 14:28 aaa -> /etc/
-rw-r--r-- 1 www-data www-data 104857600 2011-08-04 10:17 data
-rw-r--r-- 1 www-data www-data 104857600 2011-08-04 14:42 data1
-rw-r--r-- 1 www-data www-data 104857600 2011-08-04 14:42 data2
-rw-r--r-- 1 www-data www-data 18832 2011-08-04 09:44 services
此时如果启用chroot,我们将无法同步aaa这个软链接目录,如下:
rsync -avpzL 10.1.1.21::test_rsync .
receiving incremental file list
symlink has no referent: "/aaa" (in test_rsync)
./
sent 38 bytes received 203 bytes 482.00 bytes/sec
total size is 18832 speedup is 78.14
rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1526) [generator=3.0.7]
注意:同步软链接,一定要用-L参数.
11)uid/gid
指定该模块以指定的用户的uid/gid传输文件.
测试:
vi /etc/rsyncd.conf
添加如下内容:
uid = www-data
gid = www-data
客户端测试:
查看文件属主,如下:
ls -l data*
-rw-r--r-- 1 troy troy 104857600 2011-08-04 10:17 data
-rw-r--r-- 1 troy troy 104857600 2011-08-04 14:42 data1
-rw-r--r-- 1 troy troy 104857600 2011-08-04 14:42 data2
同步文件到rsync服务端,如下:
rsync -avpzL data data[1-3] 10.1.1.21::test_rsync
sending incremental file list
data
data1
data2
sent 314726513 bytes received 65 bytes 11043037.82 bytes/sec
total size is 314572800 speedup is 1.00
在服务端查看文件,如下:
ls -l
total 307512
-rw-r--r-- 1 www-data www-data 104857600 2011-08-04 10:17 data
-rw-r--r-- 1 www-data www-data 104857600 2011-08-04 14:42 data1
-rw-r--r-- 1 www-data www-data 104857600 2011-08-04 14:42 data2
注:我们看到同步后的文件owner是www-data.也就是说客户端同步文件到rsync服务端,rsync服务端会根据uid/gid将文件的属主进行修改.
而如果我们将uid/gid改为root,那么rsync不会把同步文件的uid/gid改为root,而会继续保留该UID/GID,原因是root用户可以保留owner的信息.
如下:
在客户端查看troy的uid,这里为1502
grep troy /etc/passwd
troy:x:1502:1502::/home/troy:/bin/bash
查看客户端待同步文件的owner,这里为troy
-rw-r--r-- 1 troy troy 104857600 2011-08-04 10:17 data
-rw-r--r-- 1 troy troy 104857600 2011-08-04 14:42 data1
-rw-r--r-- 1 troy troy 104857600 2011-08-04 14:42 data2
在rsync服务端将uid/gid改为root,如下:
vi /etc/rsyncd.conf
uid = root
gid = root
最后在客户端进行同步,如下:
rsync -avpzL data data[1-2] 10.1.1.21::test_rsync
sending incremental file list
data
data1
data2
sent 314726526 bytes received 65 bytes 10668698.00 bytes/sec
total size is 314572800 speedup is 1.00
查看rsync服务端的权限,如下:
ls -l data*
-rw-r--r-- 1 1502 1502 104857600 2011-08-04 10:17 data
-rw-r--r-- 1 1502 1502 104857600 2011-08-04 14:42 data1
-rw-r--r-- 1 1502 1502 104857600 2011-08-04 14:42 data2
注:我们看到文件不能显示owner的名字,而只是uid,说明如果在rsync文件中uid/gid为root,就会把权限继承过来.
12)list
指定当客户请求列出可以使用的模块列表时,该模块是否应该被列出.如果设置该选项为no,可以创建隐藏的模块.
测试:
vi /etc/rsyncd.conf
添加如下内容:
[test_rsync]
comment = "test rsync server"
path = /tmp/
list = no
use chroot = yes
uid = www-data
gid = www-data
read only = no
客户端同步测试:
rsync 10.1.1.21::
test.61.com
注:我们只看到test.61.com的模块,没看test_rsync模块.
13)read only
指定是否允许客户上传文件,若为 yes 则不允许上传；若为 no 并且服务器目录也具有读写权限则允许上传.
测试:
vi /etc/rsyncd.conf
添加如下内容:
[test_rsync]
comment = "test rsync server"
path = /tmp/
#secrets file = /etc/rsyncd.secrets
list = no
use chroot = yes
uid = root
gid = root
read only = yes
客户端同步测试:
rsync -avLpz data 10.1.1.21::test_rsync
sending incremental file list
ERROR: module is read only
rsync error: syntax or usage error (code 1) at main.c(884) [receiver=3.0.3]
rsync: read error: Connection reset by peer (104)
rsync error: error in rsync protocol data stream (code 12) at io.c(760) [sender=3.0.7]
14)write only
指定是否允许客户下载文件.若为 yes 则不允许下载;若为 no 并且服务器目录也具有读权限则允许下载
测试:
vi /etc/rsyncd.conf
添加内容如下:
[test_rsync]
comment = "test rsync server"
path = /tmp/
list = no
use chroot = yes
uid = root
gid = root
read only = no
write only = yes
客户端同步测试:
rsync -avLpz 10.1.1.21::test_rsync/data .
receiving incremental file list
ERROR: module is write only
rsync error: syntax or usage error (code 1) at main.c(710) [sender=3.0.3]
rsync: connection unexpectedly closed (5 bytes received so far) [Receiver]
rsync error: error in rsync protocol data stream (code 12) at io.c(601) [Receiver=3.0.7]
15)dont compress
用来指定那些在传输之前不进行压缩处理的文件,要防止使用压缩,应该是:”dont compress = *”
实际上该参数没什么作用,即如果客户端用rsync使用-z参数进行压缩,则dont compress无效.
如果不使用-z参数进行压缩,则默认传输是不压缩的.
测试:
vi /etc/rsyncd.conf
添加内容如下:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
timeout = 1
dont compress = *
注:这里我们拒绝所有压缩.
客户端同步测试:
rsync -avLp test --progress 10.1.1.160::website
sending incremental file list
test
1048576000 100% 11.06MB/s 0:01:30 (xfer#1, to-check=0/1)
sent 1048704065 bytes received 27 bytes 11461246.91 bytes/sec
注:采用压缩现在为每秒传输11MB的数据
下面采用压缩方式进行测试:
rsync -avLpz test --progress 10.1.1.160::website
sending incremental file list
test
1048576000 100% 21.88MB/s 0:00:45 (xfer#1, to-check=0/1)
sent 1019739 bytes received 27 bytes 19801.28 bytes/sec
total size is 1048576000 speedup is 1028.25
我们看到压缩后每秒传输21MB左右的数据,而dont compress没有发挥任何作用.
16)exclude
指定多个文件或目录(相对路径)不被同步,并将其添加到 exclude 列表中.多个文件(目录)用空格分隔.
作用等同于在客户端命令中使用--exclude来指定模式.
测试:
vi /etc/rsyncd.conf
添加内容如下:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
exclude = 1 2
这里我们排除文件(目录)1和2
服务端创建测试文件,如下:
touch 1 2 3 4 5 6 7
客户端同步文件,如下:
rsync -avLpz --progress 10.1.1.160::website .
receiving incremental file list
./
3
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=4/6)
4
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=3/6)
5
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=2/6)
6
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=1/6)
7
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=0/6)
sent 127 bytes received 300 bytes 854.00 bytes/sec
total size is 0 speedup is 0.00
注:我们看到没有同步1和2两个文件.
17)include
该选项针对于exclude,即同步exclude中的哪个文件(目录),并将其添加到include列表中.多个文件(目录)用空格分隔.
作用等同于在客户端命令中使用--include来指定模式.
测试:
vi /etc/rsyncd.conf
添加内容如下:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
exclude = 1 2
include = 1
这里我们通过exclude排除1和2两个文件(目录),又通过include包括文件名为1的文件.
客户端测试:
rsync -avLpz --progress 10.1.1.160::website .
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=5/7)
3
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=4/7)
4
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=3/7)
5
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=2/7)
6
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=1/7)
7
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=0/7)
sent 146 bytes received 334 bytes 960.00 bytes/sec
total size is 0 speedup is 0.00
注:这里rsync同步了文件1,这是因为include起了作用,文件2仍然没有被同步.
18)exclude from
作用同exclude一致,只不过是从文件中提取.
测试:
vi /etc/rsyncd.conf
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
exclude from = /tmp/exclude
这里我们通过exclude from选项加载/tmp/exclude文件.
编辑/tmp/exclude文件,如下:
echo -e "1\n2" >> /tmp/exclude
cat /tmp/exclude
1
2
客户端测试:
rsync -avLpz --progress 10.1.1.160::website .
receiving incremental file list
./
3
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=4/6)
4
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=3/6)
5
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=2/6)
6
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=1/6)
7
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=0/6)
sent 127 bytes received 292 bytes 279.33 bytes/sec
total size is 0 speedup is 0.00
我们看到没有同步1和2两个文件.
19)include from
作用同include一致,只不过是从文件中提取.
测试:
vi /etc/rsyncd.conf
添加如下选项:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
exclude from = /tmp/exclude
include from = /tmp/include
编辑include文件,如下:
echo "1" >> /tmp/include
客户端同步:
rsync -avLpz --progress 10.1.1.160::website .
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=5/7)
3
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=4/7)
4
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=3/7)
5
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=2/7)
6
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=1/7)
7
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=0/7)
sent 146 bytes received 334 bytes 960.00 bytes/sec
total size is 0 speedup is 0.00
这里没有同步文件2.
最后要说明的是客户端rsync即使加了include/exclude选项也是不能对服务端的配置产生影响.
例如:服务端有exclude 1 2 3的配置项,客户端同步时使用include 1 2 3,此时文件1 2 3仍然不会被同步下来.
20)auth users与secrets file
这两个选项只能组合使用
auth users指定由空格或逗号分隔的用户名列表,只有这些用户才允许连接该模块,这里的用户和系统用户没有任何关系.
用户名和口令以明文方式存放在 secrets file 参数指定的文件中.
测试:
vi /etc/rsyncd.conf
添加如下选项:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = www-data
secrets file = /etc/rsyncd.secret
echo "test:123456" >> /etc/rsyncd.secret
chmod 400 /etc/rsyncd.secret
客户端同步:
rsync -aLvpz --progress [email protected]::website .
Password:
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=6/8)
2
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=5/8)
3
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=4/8)
4
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=3/8)
5
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=2/8)
6
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=1/8)
7
0 100% 0.00kB/s 0:00:00 (xfer#7, to-check=0/8)
sent 193 bytes received 417 bytes 244.00 bytes/sec
total size is 0 speedup is 0.00
21)strict modes
指定是否监测口令文件的权限.若为 yes 则口令文件只能被 rsync 服务器运行身份的用户访问,其他任何用户不可以访问该文件.
默认为yes,这里我们做一下测试,如下:
vi /etc/rsyncd.conf
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = yes
设置文件/etc/rsyncd.secret为可读可写可执行,如下:
chmod 777 /etc/rsyncd.secret
客户端同步失败,如下:
rsync -aLvpz --progress [email protected]::website .
Password:
@ERROR: auth failed on module website
rsync error: error starting client-server protocol (code 5) at main.c(1524) [Receiver=3.0.7]
更改strict modes为no,如下:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = no
再次测试,如下:
rsync -aLvpz --progress [email protected]::website .
Password:
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=6/8)
2
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=5/8)
3
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=4/8)
4
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=3/8)
5
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=2/8)
6
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=1/8)
7
0 100% 0.00kB/s 0:00:00 (xfer#7, to-check=0/8)
sent 193 bytes received 417 bytes 244.00 bytes/sec
total size is 0 speedup is 0.00
22)hosts allow
用一个主机列表指定哪些主机客户允许连接该模块.不匹配主机列表的主机将被拒绝.
也就是说如果指定hosts allow那么不在hosts allow指定中的主机都将都拒绝.
测试:
vi /etc/rsyncd.conf
添加如下内容:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = yes
hosts allow = 10.1.1.163
这里指定允许10.1.1.163的主机访问该模块.
我们在10.1.1.163同步，如下:
rsync -aLvpz --progress [email protected]::website .
Password:
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=6/8)
2
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=5/8)
3
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=4/8)
4
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=3/8)
5
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=2/8)
6
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=1/8)
7
0 100% 0.00kB/s 0:00:00 (xfer#7, to-check=0/8)
sent 193 bytes received 417 bytes 244.00 bytes/sec
total size is 0 speedup is 0.00
我们在10.1.1.162上同步如下:
rsync -aLvpz --progress [email protected]::website .
@ERROR: access denied to website from unknown (10.1.1.162)
rsync error: error starting client-server protocol (code 5) at main.c(1524) [Receiver=3.0.7]
23)hosts deny
用一个主机列表指定哪些主机不能连接rsync模块.
如果hosts allow和hosts deny同时指定一台主机,则以hosts allow为准.
测试:
vi /etc/rsyncd.conf
添加内容如下:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = yes
hosts deny = 10.1.1.163
在10.1.1.163上测试,如下:
rsync -aLvpz --progress [email protected]::website .
@ERROR: access denied to website from unknown (10.1.1.163)
rsync error: error starting client-server protocol (code 5) at main.c(1524) [Receiver=3.0.7]
在10.1.1.162上测试,如下:
rsync -aLvpz --progress [email protected]::website .
Password:
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=6/8)
2
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=5/8)
3
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=4/8)
4
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=3/8)
5
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=2/8)
6
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=1/8)
7
0 100% 0.00kB/s 0:00:00 (xfer#7, to-check=0/8)
sent 193 bytes received 417 bytes 244.00 bytes/sec
total size is 0 speedup is 0.00
注:10.1.1.163上同步失败,在10.1.1.162上成功同步.
24)transfer logging
该选项开启则记录下载和上载操作.
测试:
vi /etc/rsyncd.conf
添加如下内容:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = yes
transfer logging = yes
客户端测试:
rsync -aLvpz --progress [email protected]::website .
Password:
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=6/8)
2
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=5/8)
3
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=4/8)
4
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=3/8)
5
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=2/8)
6
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=1/8)
7
0 100% 0.00kB/s 0:00:00 (xfer#7, to-check=0/8)
sent 193 bytes received 417 bytes 244.00 bytes/sec
total size is 0 speedup is 0.00
查看rsync服务端日志:
tail -f /var/log/daemon.log
Aug 18 01:13:09 debian rsyncd[18403]: name lookup failed for 10.1.1.162: Name or service not known
Aug 18 01:13:09 debian rsyncd[18403]: connect from UNKNOWN (10.1.1.162)
Aug 18 01:13:10 debian rsyncd[18403]: rsync on website/ from test@unknown (10.1.1.162)
Aug 18 01:13:10 debian rsyncd[18403]: building file list
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 1 0
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 2 0
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 3 0
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 4 0
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 5 0
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 6 0
Aug 18 01:13:10 debian rsyncd[18403]: send unknown [10.1.1.162] website (test) 7 0
Aug 18 01:13:10 debian rsyncd[18403]: sent 432 bytes received 194 bytes total size
25)log format
通过该选项用户在使用transfer logging可以自己定制日志文件的字段.
其格式是一个包含格式定义符的字符串,但要注意log format使用要在transfer logging选项开启的时候才可以.
测试:
vi /etc/rsyncd.conf
添加如下内容:
[website]
path = /var/www/
list = yes
use chroot = yes
uid = www-data
gid = www-data
read only = no
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = yes
transfer logging = yes
log format = [op]:%o [ip]:%a [module]:%m [path]:%P [file]:%f [size]:%l
注:
%o表示服务端提供什么操作,比如是接收还是发送.
%a表示客户端的IP地址.
%m表示服务端的模块.
%P表示服务端模块指定的路径.
%f表示同步的文件.
%l表示同步文件的大小.
客户端测试:
rsync -aLvpz --progress [email protected]::website .
Password:
receiving incremental file list
./
1
0 100% 0.00kB/s 0:00:00 (xfer#1, to-check=6/8)
2
0 100% 0.00kB/s 0:00:00 (xfer#2, to-check=5/8)
3
0 100% 0.00kB/s 0:00:00 (xfer#3, to-check=4/8)
4
0 100% 0.00kB/s 0:00:00 (xfer#4, to-check=3/8)
5
0 100% 0.00kB/s 0:00:00 (xfer#5, to-check=2/8)
6
0 100% 0.00kB/s 0:00:00 (xfer#6, to-check=1/8)
7
0 100% 0.00kB/s 0:00:00 (xfer#7, to-check=0/8)
sent 193 bytes received 417 bytes 406.67 bytes/sec
total size is 0 speedup is 0.00
查看服务端的rsync日志,如下:
Aug 18 14:46:43 debian rsyncd[18844]: name lookup failed for 10.1.1.162: Name or service not known
Aug 18 14:46:43 debian rsyncd[18844]: connect from UNKNOWN (10.1.1.162)
Aug 18 14:46:44 debian rsyncd[18844]: rsync on website/ from test@unknown (10.1.1.162)
Aug 18 14:46:44 debian rsyncd[18844]: building file list
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:1 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:2 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:3 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:4 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:5 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:6 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: [op]:send [ip]:10.1.1.162 [module]:website [path]:/var/www [file]:7 [size]:0
Aug 18 14:46:44 debian rsyncd[18844]: sent 432 bytes received 194 bytes total size 0
经过上面的分析整理,建议采用的配置如下:
# GLOBAL OPTIONS
################################
#显示系统提示信息
################################
motd file=/etc/motd
################################
#rsync服务绑定地址
################################
address=10.1.1.160
################################
#rsync服务绑定端口
################################
port=873
################################
#指定rsync服务的pid文件和lock文件
################################
pid file=/var/run/rsyncd.pid
lock file = /var/lock/rsyncd
################################
#指定rsync服务的日志文件
################################
log file=/var/log/rsyncd
################################
#记录rsync传输日志
################################
transfer logging = yes
################################
#定制rsync日志格式
################################
log format = [op]:%o [ip]:%a [module]:%m [path]:%P [file]:%f [size]:%l
################################
#指定syslog的facility
################################
syslog facility=daemon
################################
#最多允许5个客户端连接rsync服务器
################################
max connections=5
# MODULE OPTIONS
[website]
################################
#在list中可以显示模块信息
################################
comment = "web server"
################################
#指定同步的路径
################################
path = /var/www/
################################
#允许list该模块
################################
list = yes
################################
#开启chroot选项
################################
use chroot = yes
################################
#同步过程中使用哪个用户的uid/gid
################################
uid = www-data
gid = www-data
################################
#根据需求确认是否只读/只写
################################
read only = no
write only = no
################################
#根据需求确认是否要排除某些文件同步
################################
exclude =
include =
################################
#用户验证,必须提供相关的用户名/密码,且密码文件仅owner为可读可写
################################
auth users = test
secrets file = /etc/rsyncd.secret
strict modes = yes
################################
#只允许指定的IP可以访问rsync服务
################################
hosts allow = 10.1.1.162
hosts deny = *