Re: Restrict Distcc over SSH (command parameter)

--===============5066107669088844423==
Content-Type: multipart/alternative; boundary=001a11417c44de94d405081278df

--001a11417c44de94d405081278df
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi, Sebastian,

I don't recall the exact command, but it's probably going to be `distccd
--inet ...something...`. You might be able to see it in the distcc verbose
log.

Being able to restrict the command would be good.

However the main problem with this approach is that distccd in turn
executes a client-supplied command, and it at the moment doesn't have a way
to limit that.

Two complementary things we could do:
- run distcc within a chroot/container that contains only the compiler -
ideally, provide a reusable way for other people to set this up - at least
documentation, maybe a script
- give distccd restrictions on what commands it can run


On Sun Nov 09 2014 at 7:29:12 AM Sebastian Wieseler <
[email protected]> wrote:

> Hello Distcc List,
>
> I followed the guide http://wiki.gentoo.org/wiki/Distcc to get Distcc to
> work with SSH.
> That should work as followed:
>         /usr/bin/distcc-config --set-hosts "@test1"
>
> I just wondering how to limit the portage user to get a real SSH shell on
> the "compiling box".
> There should be a way with the .authorized_keys and the command=3D"=E2=80=
=A6"
> parameter for the SSH key.
>
> What command will be exactly executed on the remote host within the distc=
c
> call?
> To just specify command=3D"/usr/bin/distcc" does not work for example.
>
> Is there a way to make this even more secure? I couldn't find any
> information on this on the web.
> Thanks for helping.
>
> Best Regards,
> Sebastian 'kickino'
> --
>   ,=3D ,-_-. =3D.           /"\
>  ((_/)o o(\_))          \ /    ASCII Ribbon Campaign
>   `-'(. .)`-'   &&       X      against HTML e-mail
>       \_/               / \
>
>
> __
> distcc mailing list            http://distcc.samba.org/
> To unsubscribe or change options:
> https://lists.samba.org/mailman/listinfo/distcc

--001a11417c44de94d405081278df
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi, Sebastian,<div><br></div><div>I don&#39;t recall the exact command, but=
 it&#39;s probably going to be `distccd --inet ...something...`. You might =
be able to see it in the distcc verbose log.</div><div><br></div><div>Being=
 able to restrict the command would be good.</div><div><br></div><div>Howev=
er the main problem with this approach is that distccd in turn executes a c=
lient-supplied command, and it at the moment doesn&#39;t have a way to limi=
t that.</div><div><br></div><div>Two complementary things we could do:</div=
><div>- run distcc within a chroot/container that contains only the compile=
r - ideally, provide a reusable way for other people to set this up - at le=
ast documentation, maybe a script</div><div>- give distccd restrictions on =
what commands it can run</div><div><br></div><br><div class=3D"gmail_quote"=
>On Sun Nov 09 2014 at 7:29:12 AM Sebastian Wieseler &lt;<a href=3D"mailto:=
[email protected]">[email protected]</a>&gt; wrote:<br>=
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">Hello Distcc List,<br>
<br>
I followed the guide <a href=3D"http://wiki.gentoo.org/wiki/Distcc" target=
=3D"_blank">http://wiki.gentoo.org/wiki/<u></u>Distcc</a> to get Distcc to =
work with SSH.<br>
That should work as followed:<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 /usr/bin/distcc-config --set-hosts &quot;@test1=
&quot;<br>
<br>
I just wondering how to limit the portage user to get a real SSH shell on t=
he &quot;compiling box&quot;.<br>
There should be a way with the .authorized_keys and the command=3D&quot;=E2=
=80=A6&quot; parameter for the SSH key.<br>
<br>
What command will be exactly executed on the remote host within the distcc =
call?<br>
To just specify command=3D&quot;/usr/bin/distcc&quot; does not work for exa=
mple.<br>
<br>
Is there a way to make this even more secure? I couldn&#39;t find any infor=
mation on this on the web.<br>
Thanks for helping.<br>
<br>
Best Regards,<br>
Sebastian &#39;kickino&#39;<br>
--<br>
=C2=A0 ,=3D ,-_-. =3D.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/&quot;\<br>
=C2=A0((_/)o o(\_))=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 \ /=C2=A0 =C2=A0 ASCI=
I Ribbon Campaign<br>
=C2=A0 `-&#39;(. .)`-&#39;=C2=A0 =C2=A0&amp;&amp;=C2=A0 =C2=A0 =C2=A0 =C2=
=A0X=C2=A0 =C2=A0 =C2=A0 against HTML e-mail<br>
=C2=A0 =C2=A0 =C2=A0 \_/=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0/ \<br>
<br>
<br>
__<br>
distcc mailing list=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"htt=
p://distcc.samba.org/" target=3D"_blank">http://distcc.samba.org/</a><br>
To unsubscribe or change options:<br>
<a href=3D"https://lists.samba.org/mailman/listinfo/distcc" target=3D"_blan=
k">https://lists.samba.org/<u></u>mailman/listinfo/distcc</a></blockquote><=
/div>

--001a11417c44de94d405081278df--

--===============5066107669088844423==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

__
distcc mailing list            http://distcc.samba.org/
To unsubscribe or change options:
https://lists.samba.org/mailman/listinfo/distcc
--===============5066107669088844423==--