I find using yum that rsync 2.5.5-1 is the most up-to-date available (without rebuilding from source). There was an announced vulnerability in rsync though, that was only fixed with 2.5.7. Was the fix backported to 2.5.5, or is this vulnerability technically present in YDL 3.x? Stefan Jeglisnki