Re: [gentoo-security] Securing portage --- an OpenBSD approach

[Paul de Vrieze]

On Friday 12 November 2004 16:54, Brian G. Peterson wrote:
> On Friday 12 November 2004 09:02 am, Dan Margolis wrote:
> > Klaus Wagner wrote:
> > > I think if the rsync mirrors are too stressed for signation, they would
> > > be too stressed for rsync too, allthough rsync could be tunneled too.
> >
> > One of the suggestions we were kicking around was to use Stunnel to
> > encrypt rsync over SSL. This, of course, fails to be as encompassing as
> > the Final Solution involving GPG, but is suitable as a stopgap. We
> > rejected it because of concern about server load on the mirrors,
> > actually, since SSL does introduce some significant CPU overhead.
>
> wouldn't public-key rsync over ssh be a lower CPU load option than rsync
> over SSL?  This option would also be suitable as a 'secure rsync' method
> for remote users, if you wanted to push it out that far.  I can see how CPU
> load for remote users to tunnel rsync over SSL or ssh, but the connection
> between the Gentoo rsync master and the mirrors could be secured this way.

The difference between ssh and ssl is very minimal in terms of performance, 
however ssl focusses on public services with public certificates, while ssh 
focusses on authenticated shell access to known users. The load difference 
should be minimal anyway, but ssh is not suitable for the public rsync 
service, for inter-mirror rsync it would be acceptable.

Paul

-- 
Paul de Vrieze
Gentoo Developer
Mail: pauldv@g.o
Homepage: http://www.devrieze.net