[rsync] Add plugin for the rsync daemon

[suraj-cmd]

rsyncd is packaged and shipped as a service on RHEL, Fedora, Debian and
Ubuntu, but sos has no plugin for it and no other plugin references rsync. An
sosreport taken from an rsync server currently contains none of its
configuration, logs or service state.

The plugin collects rsyncd.conf and the drop-in directory, the distribution
defaults files, the daemon log, rsync --version, and the service status and
journal for both the service and socket-activated forms.

A module using auth users points at a secrets file holding
username:password pairs in cleartext. Those paths are added to the forbidden
list so they cannot be collected under any option combination, including
--all-logs.

I do not have an rsyncd deployment to test against. Confirmation of the
/etc/rsyncd.d/ drop-in path and of the systemd unit names across
distributions would be welcome — the forbidden-path list is the part I would
most like a second opinion on.

---

Please place an 'X' inside each '[]' to confirm you adhere to our Contributor Guidelines

• Is the commit message split over multiple lines and hard-wrapped at 72 characters?
• Is the subject and message clear and concise?
• Does the subject start with [plugin_name] if submitting a plugin patch or a [section_name] if part of the core sosreport code?
• Does the commit contain a Signed-off-by: First Lastname email@example.com?
• Are any related Issues or existing PRs properly referenced via a Closes (Issue) or Resolved (PR) line?
• Are all passwords or private data gathered by this PR obfuscated?

[packit-as-a-service]

Congratulations! One of the builds has completed. 🍾

You can install the built RPMs by following these steps:

• sudo dnf install -y 'dnf*-command(copr)'
• dnf copr enable packit/sosreport-sos-4420
• And now you can install the packages.

Please note that the RPMs should be used only in a testing environment.

[arif-ali]

please test the plugin to ensure that all is collected correctly

[arif-ali]

as per previous message, please test the plugin

[suraj-cmd]

Tested on RHEL 10 (aarch64), rsync 3.4.1, with a module using auth users
pointing at /etc/rsyncd.secrets:

[backup]
path = /srv/backup
auth users = testuser
secrets file = /etc/rsyncd.secrets

# sudo python3 bin/sos report -o rsync --batch --build

Collected:

etc/rsyncd.conf
var/log/rsyncd.log
sos_commands/rsync/rsync_--version
sos_commands/rsync/journalctl_--no-pager_--unit_rsyncd_.service

Not collected, as intended:

# find $SOSDIR -name '*secrets*'
(no output)
# grep -r "SuperSecret123" $SOSDIR ; echo "exit=$?"
exit=1

The collected rsyncd.conf still contains secrets file = /etc/rsyncd.secrets,
so the path is recorded while the credentials themselves are not.

[suraj-cmd]

One clarification on the output above: rsync-daemon isn't installable on that
system, so rsyncd.service doesn't exist and the daemon was started with
rsync --daemon. That's why there's no systemctl_status_rsyncd — is_service()
returns False and the services tuple correctly skips it. Confirmation from
someone with the package installed would be welcome.

The force-push also declares the units in the services tuple rather than
explicit add_service_status()/add_journal() calls, per @TurboTurtle's review
on #4429.

[bmr-cymru]

Tested with default configuration of rsync-daemon-3.4.4-1.el10.noarch on CentOS 10:

[plugin:rsync] added cmd output 'systemctl status rsyncd'
[plugin:rsync] collecting journal: journalctl --no-pager  --unit rsyncd --reverse
[plugin:rsync] packed command: changes=False, cmd=journalctl --no-pager  --unit rsyncd --reverse, priority=10, sizelimit=100, suggest_filename=journalctl --no-pager  --unit rsyncd, tac=True, tags=['journal_rsyncd'], timeout=None, to_file=True
[plugin:rsync] added cmd output 'journalctl --no-pager  --unit rsyncd --reverse'
[plugin:rsync] adding forbidden path '/etc/rsyncd.secrets'
[plugin:rsync] adding forbidden path '/etc/rsync.secrets'
[plugin:rsync] adding forbidden path '/etc/rsyncd.d/*.secrets'
[plugin:rsync] packed command: binary=False, changes=False, chroot=True, cmd=rsync --version, cmd_as_tag=False, container_cmd=None, env=None, foreground=False, priority=10, root_symlink=None, runas=None, runat=None, sizelimit=25, stderr=True, stdin=None, subdir=None, suggest_filename=None, tags=rsync_version, timeout=None, to_file=False
[plugin:rsync] added cmd output 'rsync --version'
[plugin:rsync] collecting journal: journalctl --no-pager  --unit rsyncd@.service --reverse
[plugin:rsync] packed command: changes=False, cmd=journalctl --no-pager  --unit rsyncd@.service --reverse, priority=10, sizelimit=100, suggest_filename=journalctl --no-pager  --unit rsyncd@.service, tac=True, tags=['journal_rsyncd@.service'], timeout=None, to_file=True
[plugin:rsync] added cmd output 'journalctl --no-pager  --unit rsyncd@.service --reverse'
 Running plugins. Please wait ...

  Starting 1/1   rsync           [Running: rsync]
[plugin:rsync] collecting path '/etc/sysconfig/rsyncd'
[plugin:rsync] copying path '/etc/sysconfig/rsyncd' to archive:'/etc/sysconfig/rsyncd'
[plugin:rsync] collecting path '/etc/rsyncd.conf'
[plugin:rsync] copying path '/etc/rsyncd.conf' to archive:'/etc/rsyncd.conf'
[plugin:rsync] unpacked command: binary=False, changes=False, chroot=True, cmd=systemctl status rsyncd, cmd_as_tag=False, container_cmd=None, env=None, foreground=False, priority=10, root_symlink=None, runas=None, runat=None, sizelimit=25, stderr=True, stdin=None, subdir=None, suggest_filename=None, tags=[], timeout=None, to_file=False
[plugin:rsync] collecting output of 'systemctl status rsyncd'
[plugin:rsync] collected output of 'systemctl' in 0.014885425567626953 (changes=False)
[plugin:rsync] unpacked command: changes=False, cmd=journalctl --no-pager  --unit rsyncd --reverse, priority=10, sizelimit=100, suggest_filename=journalctl --no-pager  --unit rsyncd, tac=True, tags=['journal_rsyncd'], timeout=None, to_file=True
[plugin:rsync] collecting output of 'journalctl --no-pager  --unit rsyncd --reverse'
[plugin:rsync] collecting 'journalctl --no-pager  --unit rsyncd --reverse' output directly to disk
[plugin:rsync] collected output of 'journalctl' in 0.016019344329833984 (changes=False)
[plugin:rsync] unpacked command: binary=False, changes=False, chroot=True, cmd=rsync --version, cmd_as_tag=False, container_cmd=None, env=None, foreground=False, priority=10, root_symlink=None, runas=None, runat=None, sizelimit=25, stderr=True, stdin=None, subdir=None, suggest_filename=None, tags=rsync_version, timeout=None, to_file=False
[plugin:rsync] collecting output of 'rsync --version'
[plugin:rsync] collected output of 'rsync' in 0.015042304992675781 (changes=False)
[plugin:rsync] unpacked command: changes=False, cmd=journalctl --no-pager  --unit rsyncd@.service --reverse, priority=10, sizelimit=100, suggest_filename=journalctl --no-pager  --unit rsyncd@.service, tac=True, tags=['journal_rsyncd@.service'], timeout=None, to_file=True
[plugin:rsync] collecting output of 'journalctl --no-pager  --unit rsyncd@.service --reverse'
[plugin:rsync] collecting 'journalctl --no-pager  --unit rsyncd@.service --reverse' output directly to disk

Collected files as expected:

/var/tmp/sosreport-vm-10-0-186-137-2026-08-10-hxfoupf/
├── etc
│   ├── rsyncd.conf
│   └── sysconfig
│       └── rsyncd
├── sos_commands
│   └── rsync
│       ├── journalctl_--no-pager_--unit_rsyncd
│       ├── journalctl_--no-pager_--unit_rsyncd_.service
│       ├── rsync_--version
│       └── systemctl_status_rsyncd

# cat sos_commands/rsync/systemctl_status_rsyncd 
● rsyncd.service - fast remote file copy program daemon
     Loaded: loaded (/usr/lib/systemd/system/rsyncd.service; enabled; preset: disabled)
     Active: active (running) since Mon 2026-08-10 13:36:00 EDT; 6s ago
 Invocation: 2ea34d6cd1d64a55b2ab883ab7e56b1b
   Main PID: 6732 (rsync)
      Tasks: 1 (limit: 10532)
     Memory: 936K (peak: 1M)
        CPU: 5ms
     CGroup: /system.slice/rsyncd.service
             └─6732 /usr/bin/rsync --daemon --no-detach

Aug 10 13:36:00 vm-10-0-186-137.xyz.example.com systemd[1]: Started rsyncd.service - fast remote file copy program daemon.
Aug 10 13:36:00 vm-10-0-186-137.xyz.example.com rsyncd[6732]: rsyncd version 3.4.4 starting, listening on port 873

[suraj-cmd]

@bmr-cymru, can we merge this if everything is working as expected?

[suraj-cmd]

@bmr-cymru or @arif-ali can we gohead with merge or is there any problem here ?

[TurboTurtle]

One note follows.

Please add an Assisted-by line to the commit message when using an AI assistant as per our AI policy.

[TurboTurtle]

Don't put sockets here, as sockets are not services under systemd.