Re: Restrict Distcc over SSH (command parameter)
Martin Pool <[email protected]> Tue, 18 Nov 2014 09:58:30 -0800
| Newsgroups | gmane.comp.compilers.distcc |
|---|---|
| Message-ID | <CAA9uavDo2Ts51oKNpKu4jY2rJXNb+-DL5V7typEOmEO5SfpOCA@mail.gmail.com> |
--===============8853304186576295166== Content-Type: multipart/alternative; boundary=001a113d104690c467050825d9fe --001a113d104690c467050825d9fe Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Thanks, Fergus. But how do those variables get set if it's invoked over ssh= ? On Tue, Nov 18, 2014 at 1:15 AM, Fergus Henderson <[email protected]> wrote= : > > On 17 Nov 2014 18:52, "Martin Pool" <[email protected]> wrote: > > > > Hi, Sebastian, > > > > I don't recall the exact command, but it's probably going to be `distcc= d > --inet ...something...`. You might be able to see it in the distcc verbos= e > log. > > > > Being able to restrict the command would be good. > > > > However the main problem with this approach is that distccd in turn > executes a client-supplied command, and it at the moment doesn't have a w= ay > to limit that. > > Actually we do have a way to limit that, via commands.allow.sh which is > executed by /etc/init.d/distccd and which sets environment variables used > by distccd. > > See the following extract from the distccd man page: > > ----- > *ENVIRONMENT VARIABLES* > > *DISTCC_**CMDLIST* > If the environment variable DISTCC_CMDLIST is set, load a list of > supported commands from the file named by DISTCC_CMDLIST, and refuse to > serve any command whose last DISTCC_CMDLIST_MATCHWORDS last words do not > match those of a command in that list. See the comments in src/serve.c. > > *DISTCC_**CMDLIST**_**NUMWORDS* > The number of words, from the end of the command, to match. The default i= s > 1. > ---- > > > Two complementary things we could do: > > - run distcc within a chroot/container that contains only the compiler = - > ideally, provide a reusable way for other people to set this up - at leas= t > documentation, maybe a script > > - give distccd restrictions on what commands it can run > > > > > > On Sun Nov 09 2014 at 7:29:12 AM Sebastian Wieseler < > [email protected]> wrote: > >> > >> Hello Distcc List, > >> > >> I followed the guide http://wiki.gentoo.org/wiki/Distcc to get Distcc > to work with SSH. > >> That should work as followed: > >> /usr/bin/distcc-config --set-hosts "@test1" > >> > >> I just wondering how to limit the portage user to get a real SSH shell > on the "compiling box". > >> There should be a way with the .authorized_keys and the command=3D"=E2= =80=A6" > parameter for the SSH key. > >> > >> What command will be exactly executed on the remote host within the > distcc call? > >> To just specify command=3D"/usr/bin/distcc" does not work for example. > >> > >> Is there a way to make this even more secure? I couldn't find any > information on this on the web. > >> Thanks for helping. > >> > >> Best Regards, > >> Sebastian 'kickino' > >> -- > >> ,=3D ,-_-. =3D. /"\ > >> ((_/)o o(\_)) \ / ASCII Ribbon Campaign > >> `-'(. .)`-' && X against HTML e-mail > >> \_/ / \ > >> > >> > >> __ > >> distcc mailing list http://distcc.samba.org/ > >> To unsubscribe or change options: > >> https://lists.samba.org/mailman/listinfo/distcc > > > > > > __ > > distcc mailing list http://distcc.samba.org/ > > To unsubscribe or change options: > > https://lists.samba.org/mailman/listinfo/distcc > --=20 Martin --001a113d104690c467050825d9fe Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Thanks, Fergus. But how do those variables get set if it&#= 39;s invoked over ssh?</div><div class=3D"gmail_extra"><br><div class=3D"gm= ail_quote">On Tue, Nov 18, 2014 at 1:15 AM, Fergus Henderson <span dir=3D"l= tr"><<a href=3D"mailto:[email protected]" target=3D"_blank">fergus@googl= e.com</a>></span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"m= argin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class= =3D""><p dir=3D"ltr"><br> On 17 Nov 2014 18:52, "Martin Pool" <<a href=3D"mailto:mbp@sou= rcefrog.net" target=3D"_blank">[email protected]</a>> wrote:<br> ><br> > Hi, Sebastian,<br> ><br> > I don't recall the exact command, but it's probably going to b= e `distccd --inet ...something...`. You might be able to see it in the dist= cc verbose log.<br> ><br> > Being able to restrict the command would be good.<br> ><br> > However the main problem with this approach is that distccd in turn ex= ecutes a client-supplied command, and it at the moment doesn't have a w= ay to limit that.</p> </span><p dir=3D"ltr">Actually we do have a way to limit that, via <a href= =3D"http://commands.allow.sh" target=3D"_blank">commands.allow.sh</a> which= is executed by /etc/init.d/distccd and which sets environment variables us= ed by distccd.</p> <p dir=3D"ltr">See the following extract from the distccd man page:</p> <p dir=3D"ltr">-----<br> <b>ENVIRONMENT VARIABLES</b><br></p> <p dir=3D"ltr"><b>DISTCC_</b><b>CMDLIST</b><br> If the environment variable DISTCC_CMDLIST is set, load a list of supported= commands from the file named by DISTCC_CMDLIST, and refuse to serve any co= mmand whose last DISTCC_CMDLIST_MATCHWORDS last words do not match those of= a command in that list. See the comments in src/serve.c.</p> <p dir=3D"ltr"><b>DISTCC_</b><b>CMDLIST</b><b>_</b><b>NUMWORDS</b><br> The number of words, from the end of the command, to match. The default is = 1.<br> ----<br><br></p><div class=3D"HOEnZb"><div class=3D"h5"> <p dir=3D"ltr">> Two complementary things we could do:<br> > - run distcc within a chroot/container that contains only the compiler= - ideally, provide a reusable way for other people to set this up - at lea= st documentation, maybe a script<br> > - give distccd restrictions on what commands it can run<br> ><br> ><br> > On Sun Nov 09 2014 at 7:29:12 AM Sebastian Wieseler <<a href=3D"mai= lto:[email protected]" target=3D"_blank">sebastian@nanofortnight.= org</a>> wrote:<br> >><br> >> Hello Distcc List,<br> >><br> >> I followed the guide<a href=3D"http://wiki.gentoo.org/wiki/Distcc"= target=3D"_blank"> http://wiki.gentoo.org/wiki/Distcc</a> to get Distcc to= work with SSH.<br> >> That should work as followed:<br> >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 /usr/bin/distcc-config --set-hosts &qu= ot;@test1"<br> >><br> >> I just wondering how to limit the portage user to get a real SSH s= hell on the "compiling box".<br> >> There should be a way with the .authorized_keys and the command=3D= "=E2=80=A6" parameter for the SSH key.<br> >><br> >> What command will be exactly executed on the remote host within th= e distcc call?<br> >> To just specify command=3D"/usr/bin/distcc" does not wor= k for example.<br> >><br> >> Is there a way to make this even more secure? I couldn't find = any information on this on the web.<br> >> Thanks for helping.<br> >><br> >> Best Regards,<br> >> Sebastian 'kickino'<br> >> --<br> >> =C2=A0 ,=3D ,-_-. =3D.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/&q= uot;\<br> >> =C2=A0((_/)o o(\_))=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 \ /=C2=A0 = =C2=A0 ASCII Ribbon Campaign<br> >> =C2=A0 `-'(. .)`-'=C2=A0 =C2=A0&&=C2=A0 =C2=A0 =C2= =A0 =C2=A0X=C2=A0 =C2=A0 =C2=A0 against HTML e-mail<br> >> =C2=A0 =C2=A0 =C2=A0 \_/=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0/ \<br> >><br> >><br> >> __<br> >> distcc mailing list=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<a hre= f=3D"http://distcc.samba.org/" target=3D"_blank"> http://distcc.samba.org/<= /a><br> >> To unsubscribe or change options:<br> >><a href=3D"https://lists.samba.org/mailman/listinfo/distcc" target= =3D"_blank"> https://lists.samba.org/mailman/listinfo/distcc</a><br> ><br> ><br> > __<br> > distcc mailing list=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D= "http://distcc.samba.org/" target=3D"_blank"> http://distcc.samba.org/</a><= br> > To unsubscribe or change options:<br> ><a href=3D"https://lists.samba.org/mailman/listinfo/distcc" target=3D"_= blank"> https://lists.samba.org/mailman/listinfo/distcc</a><br> </p> </div></div></blockquote></div><br><br clear=3D"all"><div><br></div>-- <br>= <div class=3D"gmail_signature">Martin<br></div> </div> --001a113d104690c467050825d9fe-- --===============8853304186576295166== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline __ distcc mailing list http://distcc.samba.org/ To unsubscribe or change options: https://lists.samba.org/mailman/listinfo/distcc --===============8853304186576295166==--