Date: Wed, 9 Jun 2004 07:52:23 -0700 From: "Crist J. Clark" <cristjc@comcast.net> To: Doug Barton <DougB@FreeBSD.org> Cc: Dan Rue <drue@therub.org> Subject: Re: [Freebsd-security] Re: Multi-User Security Message-ID: <20040609145223.GA53862@blossom.cjclark.org> In-Reply-To: <20040609050217.Q5839@ync.qbhto.arg> References: <20040518160517.GA10067@therub.org> <OPEPILILPLAKPFCNKOKAGEGHCBAA.remko@elvandar.org> <20040520033024.GA26640@therub.org> <20040606233720.F1850@ync.qbhto.arg> <20040607204149.GC75747@blossom.cjclark.org> <20040609050217.Q5839@ync.qbhto.arg>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Jun 09, 2004 at 05:03:02AM -0700, Doug Barton wrote:
> On Mon, 7 Jun 2004, Crist J. Clark wrote:
>
> >On Sun, Jun 06, 2004 at 11:38:55PM -0700, Doug Barton wrote:
> >>On Wed, 19 May 2004, Dan Rue wrote:
> >>
> >>>You obviously havn't tried to chroot scponly users.. _that's_ the tricky
> >>>part. Especially if you want it to scale up beyond a handful of users.
> >>>If i'm wrong - fill me in i'd love to hear how to do it.
> >>
> >>Have you considered using ~/.ssh/authorized_keys to restrict the account
> >>from tty access? This would allow you to do commands (like scp) without
> >>the risk of the user getting an actual shell.
> >
> > $ ssh host /bin/sh
> >
> >You don't need a tty to get an interactive shell.
>
> You can also enforce what commands the user can run to prevent this.
> Read sshd(8) for more information.
If you are talking about the "command" option for an authorized key,
that is a useful functionality, but it does not really apply to the
scp(1) case. If there is some other way to restrict the commands
a user can execute via sshd(8) (besides passing the user to a
restricted shell or other external control), I'm sorry, but I'm not
catching on.
Using command restrictions for authorized keys doesn't work for scp(1)
since doing,
$ scp host1:file1 file2
Actually runs,
$ ssh host1 scp -f file1
As far as the SSH client-server interaction goes, you cannot specify
a command in the authorized keys file and still have scp(1) work.
Also due to the fact scp(1) works in this manner, any "scp-only" setup
has to be able to defeat,
$ ssh host1:'file1; command arg1 ..' file2
For example, try,
$ scp host1:'/etc/motd; touch scp_test' /dev/null
And check for 'scp_test' in the user's home directory on the server.
To do scp-only, you either need (a) a hacked up sshd(8) daemon, (b) a
jailed environment, or (c) a special shell for the user that only allows
scp(1) to run. The funny thing is, I think (c) is probably the easiest
to implement on a mass scale, but seems to be the option most seldom
considered.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040609145223.GA53862>