{
  "port": 873,
  "protocol": "tcp",
  "service": "rsync daemon",
  "oneLiner": "rsync in daemon mode — public mirrors run it on purpose, and so do accidentally exposed backups.",
  "whatItIs": "Running `rsync --daemon` opens TCP 873 and serves named modules defined in rsyncd.conf, each mapping to a directory tree with its own read-only, auth-users and hosts-allow settings. This is the native rsync protocol, not rsync-over-SSH, and modules configured without auth-users are readable by anyone who connects — which is exactly how Linux distribution and CPAN mirrors are meant to work. It is also the classic accidental data leak: a backup module left world-readable, or worse, writable. Listing modules requires no credentials, so a connect immediately tells you what is on offer.",
  "exposure": {
    "verdict": "careful",
    "note": "Fine for a deliberate public mirror with read-only modules; anything else needs auth-users, hosts-allow, and a check that no module exports a filesystem root."
  },
  "checkCommand": "rsync rsync://rsync.samba.org/",
  "links": [
    {
      "title": "rsync project home",
      "url": "https://rsync.samba.org/",
      "kind": "official-docs"
    },
    {
      "title": "rsyncd.conf(5) manual page",
      "url": "https://download.samba.org/pub/rsync/rsyncd.conf.5",
      "kind": "official-docs"
    },
    {
      "title": "rsync source repository",
      "url": "https://github.com/RsyncProject/rsync",
      "kind": "github"
    }
  ]
}