Re: Restrict Distcc over SSH (command parameter)
Fergus Henderson <[email protected]> Tue, 18 Nov 2014 09:15:46 +0000
| Newsgroups | gmane.comp.compilers.distcc |
|---|---|
| Message-ID | <CAPXkjd86dv3AJ9fvdu3W+ziwzc0-EftFBAKxfJa0WHCSYASOGQ@mail.gmail.com> |
--===============4257074377846899541== Content-Type: multipart/alternative; boundary=089e01538db2528dac05081e8ae4 --089e01538db2528dac05081e8ae4 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 17 Nov 2014 18:52, "Martin Pool" <[email protected]> wrote: > > Hi, Sebastian, > > I don't recall the exact command, but it's probably going to be `distccd --inet ...something...`. You might be able to see it in the distcc verbose log. > > Being able to restrict the command would be good. > > However the main problem with this approach is that distccd in turn executes a client-supplied command, and it at the moment doesn't have a way to limit that. Actually we do have a way to limit that, via commands.allow.sh which is executed by /etc/init.d/distccd and which sets environment variables used by distccd. See the following extract from the distccd man page: ----- *ENVIRONMENT VARIABLES* *DISTCC_**CMDLIST* If the environment variable DISTCC_CMDLIST is set, load a list of supported commands from the file named by DISTCC_CMDLIST, and refuse to serve any command whose last DISTCC_CMDLIST_MATCHWORDS last words do not match those of a command in that list. See the comments in src/serve.c. *DISTCC_**CMDLIST**_**NUMWORDS* The number of words, from the end of the command, to match. The default is 1. ---- > Two complementary things we could do: > - run distcc within a chroot/container that contains only the compiler - ideally, provide a reusable way for other people to set this up - at least documentation, maybe a script > - give distccd restrictions on what commands it can run > > > On Sun Nov 09 2014 at 7:29:12 AM Sebastian Wieseler < [email protected]> wrote: >> >> Hello Distcc List, >> >> I followed the guide http://wiki.gentoo.org/wiki/Distcc to get Distcc to work with SSH. >> That should work as followed: >> /usr/bin/distcc-config --set-hosts "@test1" >> >> I just wondering how to limit the portage user to get a real SSH shell on the "compiling box". >> There should be a way with the .authorized_keys and the command=3D"=E2= =80=A6" parameter for the SSH key. >> >> What command will be exactly executed on the remote host within the distcc call? >> To just specify command=3D"/usr/bin/distcc" does not work for example. >> >> Is there a way to make this even more secure? I couldn't find any information on this on the web. >> Thanks for helping. >> >> Best Regards, >> Sebastian 'kickino' >> -- >> ,=3D ,-_-. =3D. /"\ >> ((_/)o o(\_)) \ / ASCII Ribbon Campaign >> `-'(. .)`-' && X against HTML e-mail >> \_/ / \ >> >> >> __ >> distcc mailing list http://distcc.samba.org/ >> To unsubscribe or change options: >> https://lists.samba.org/mailman/listinfo/distcc > > > __ > distcc mailing list http://distcc.samba.org/ > To unsubscribe or change options: > https://lists.samba.org/mailman/listinfo/distcc --089e01538db2528dac05081e8ae4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <p dir=3D"ltr"><br> On 17 Nov 2014 18:52, "Martin Pool" <<a href=3D"mailto:mbp@sou= rcefrog.net">[email protected]</a>> wrote:<br> ><br> > Hi, Sebastian,<br> ><br> > I don't recall the exact command, but it's probably going to b= e `distccd --inet ...something...`. You might be able to see it in the dist= cc verbose log.<br> ><br> > Being able to restrict the command would be good.<br> ><br> > However the main problem with this approach is that distccd in turn ex= ecutes a client-supplied command, and it at the moment doesn't have a w= ay to limit that.</p> <p dir=3D"ltr">Actually we do have a way to limit that, via <a href=3D"http= ://commands.allow.sh">commands.allow.sh</a> which is executed by /etc/init.= d/distccd and which sets environment variables used by distccd.</p> <p dir=3D"ltr">See the following extract from the distccd man page:</p> <p dir=3D"ltr">-----<br> <b>ENVIRONMENT VARIABLES</b><br></p> <p dir=3D"ltr"><b>DISTCC_</b><b>CMDLIST</b><br> If the environment variable DISTCC_CMDLIST is set, load a list of supported= commands from the file named by DISTCC_CMDLIST, and refuse to serve any co= mmand whose last DISTCC_CMDLIST_MATCHWORDS last words do not match those of= a command in that list. See the comments in src/serve.c.</p> <p dir=3D"ltr"><b>DISTCC_</b><b>CMDLIST</b><b>_</b><b>NUMWORDS</b><br> The number of words, from the end of the command, to match. The default is = 1.<br> ----<br><br></p> <p dir=3D"ltr">> Two complementary things we could do:<br> > - run distcc within a chroot/container that contains only the compiler= - ideally, provide a reusable way for other people to set this up - at lea= st documentation, maybe a script<br> > - give distccd restrictions on what commands it can run<br> ><br> ><br> > On Sun Nov 09 2014 at 7:29:12 AM Sebastian Wieseler <<a href=3D"mai= lto:[email protected]">[email protected]</a>> wrote:= <br> >><br> >> Hello Distcc List,<br> >><br> >> I followed the guide<a href=3D"http://wiki.gentoo.org/wiki/Distcc"= > http://wiki.gentoo.org/wiki/Distcc</a> to get Distcc to work with SSH.<br= > >> That should work as followed:<br> >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 /usr/bin/distcc-config --set-hosts &qu= ot;@test1"<br> >><br> >> I just wondering how to limit the portage user to get a real SSH s= hell on the "compiling box".<br> >> There should be a way with the .authorized_keys and the command=3D= "=E2=80=A6" parameter for the SSH key.<br> >><br> >> What command will be exactly executed on the remote host within th= e distcc call?<br> >> To just specify command=3D"/usr/bin/distcc" does not wor= k for example.<br> >><br> >> Is there a way to make this even more secure? I couldn't find = any information on this on the web.<br> >> Thanks for helping.<br> >><br> >> Best Regards,<br> >> Sebastian 'kickino'<br> >> --<br> >> =C2=A0 ,=3D ,-_-. =3D.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/&q= uot;\<br> >> =C2=A0((_/)o o(\_))=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 \ /=C2=A0 = =C2=A0 ASCII Ribbon Campaign<br> >> =C2=A0 `-'(. .)`-'=C2=A0 =C2=A0&&=C2=A0 =C2=A0 =C2= =A0 =C2=A0X=C2=A0 =C2=A0 =C2=A0 against HTML e-mail<br> >> =C2=A0 =C2=A0 =C2=A0 \_/=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0/ \<br> >><br> >><br> >> __<br> >> distcc mailing list=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<a hre= f=3D"http://distcc.samba.org/"> http://distcc.samba.org/</a><br> >> To unsubscribe or change options:<br> >><a href=3D"https://lists.samba.org/mailman/listinfo/distcc"> https:= //lists.samba.org/mailman/listinfo/distcc</a><br> ><br> ><br> > __<br> > distcc mailing list=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D= "http://distcc.samba.org/"> http://distcc.samba.org/</a><br> > To unsubscribe or change options:<br> ><a href=3D"https://lists.samba.org/mailman/listinfo/distcc"> https://li= sts.samba.org/mailman/listinfo/distcc</a><br> </p> --089e01538db2528dac05081e8ae4-- --===============4257074377846899541== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline __ distcc mailing list http://distcc.samba.org/ To unsubscribe or change options: https://lists.samba.org/mailman/listinfo/distcc --===============4257074377846899541==--