Date: Thu, 28 Mar 2002 11:03:51 +0200 (EET) From: Domas Mituzas <domas.mituzas@delfi.lt> To: Jason Stone <jason@shalott.net> Cc: Fernan Aguero <fernan@iib.unsam.edu.ar>, FreeBSD Security <freebsd-security@FreeBSD.ORG> Subject: Re: using ssh to run remote commands? Message-ID: <20020328105535.W10792-100000@axis.tdd.lt> In-Reply-To: <20020328003857.J5333-100000@walter>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi, I've been using my simplified shell for theese reasons. I use it for invoking programs/scripts in ~/bin/ (owned not by user). Here's the small source. Keep in mind it understands whitespace separated strings as different arguments, but it isn't my trouble actually. It is called dsh (dumb shell, dammit-shell, delfi-shell, whatever :) and is main component of my service http://shells.dammit.lt/ (sorry all content is in Lithuanian, but you'd find it really amusing =) Right now I'm also implementing kind of sexec idea - passing of argv as binary data structure via ssh tunnels and calling exec on remote side. Of course that should introduce additional check, as right now ability to exec is specified by how user's shell interprets -c argument. This security issue can be easily resolved by AllowExec parameter in sshd.conf. dumbsh was intermediate step to normal secure remote procedure call. BR, Domas /* $Id: main.c,v 1.6 2001/11/03 14:33:23 midom Exp $ */ #include <unistd.h> #include <stdio.h> #include <string.h> #define MAXARGS 10 #define ONLY "bin/" int main(int ac, char **av) { char **ap, *argv[MAXARGS], *is; /* * skip first two arguments - the first gives shell name, that we * know and the second gives "-c" that we also know */ av += 2; is = av[0]; if (ac < 2) exit(0); /* build argv from stupid string */ for (ap = argv; (*ap = (char *) strsep(&is, " \t")) != NULL;) if (**ap != '\0') if (++ap >= &argv[MAXARGS]) break; /* check for l33t guys */ if (strstr(argv[0], "..") != NULL) { printf("breakin attempt\n"); exit(0); } /* limiting access and running program */ if (!strncmp(argv[0], ONLY, strlen(ONLY) - 1)) execv(argv[0], argv); return (1); } > You can't - ssh will always try to run a command by calling the user's > shell, so unless you patch it, you _must_ give the user a valid shell. > > The best you can do is to give the user a valid shell but an invalid > password (eg, "*") and use ssh keys to authenticate. For additional > security, you can specify a command along with the key in the > authorized_keys file so that the key can _only_ be used to run that > command (and not to get a shell). man ssh, ssh-keygen. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020328105535.W10792-100000>