Re: Restrict Distcc over SSH (command parameter)

--===============3697583410530454755==
Content-Type: multipart/alternative; boundary=001a11c29c9e9103ff05092cd69c

--001a11c29c9e9103ff05092cd69c
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Just to be clear, that's not going to stop a determined attacker running
arbitrary commands via distccd. It will stop people accidentally logging in=
.

I think you wouldn't need a specific sshd in the chroot - perhaps a little
wrapper under the name 'distccd' that moves into that chroot would be
enough, or perhaps we could do something through the users' shell. It would
be nice to document/script this.

On Sun Nov 30 2014 at 1:03:12 PM Sebastian Wieseler <
[email protected]> wrote:

> Hey Martin!
>
> On Mon, Nov 17, 2014 at 06:51:47PM +0000, Martin Pool wrote:
> > I don't recall the exact command, but it's probably going to be `distcc=
d
> > --inet ...something...`. You might be able to see it in the distcc
> verbose
> > log.
>
> This really helped. :-)
> my .ssh/authorized_keys file looks now like:
> from=3D"xxx.xxx.xxx.xxx",no-agent-forwarding,no-port-
> forwarding,no-X11-forwarding,no-pty,command=3D"distccd --inetd" ssh-rsa =
=E2=80=A6
>
> This works totally fine for me.
>
> The problem with a chroot would be, that you would need then a sshd in
> that chroot as well?
> To just encrypt the traffic and have some kind of authentication, a norma=
l
> sshd should do the job as well.
> And since the distcc remote user can only execute "distccd --inetd" it
> should be ok :)
>
> Thank you very much again!
> Regards, Sebastian
>
>
> --
>   ,=3D ,-_-. =3D.           /"\
>  ((_/)o o(\_))          \ /    ASCII Ribbon Campaign
>   `-'(. .)`-'   &&       X      against HTML e-mail
>       \_/               / \
>
>
>

--001a11c29c9e9103ff05092cd69c
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Just to be clear, that&#39;s not going to stop a determined attacker runnin=
g arbitrary commands via distccd. It will stop people accidentally logging =
in.<br><div><br></div><div>I think you wouldn&#39;t need a specific sshd in=
 the chroot - perhaps a little wrapper under the name &#39;distccd&#39; tha=
t moves into that chroot would be enough, or perhaps we could do something =
through the users&#39; shell. It would be nice to document/script this.</di=
v><br><div class=3D"gmail_quote">On Sun Nov 30 2014 at 1:03:12 PM Sebastian=
 Wieseler &lt;<a href=3D"mailto:[email protected]">sebastian@nano=
fortnight.org</a>&gt; wrote:<br><blockquote class=3D"gmail_quote" style=3D"=
margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hey Martin!<=
br>
<br>
On Mon, Nov 17, 2014 at 06:51:47PM +0000, Martin Pool wrote:<br>
&gt; I don&#39;t recall the exact command, but it&#39;s probably going to b=
e `distccd<br>
&gt; --inet ...something...`. You might be able to see it in the distcc ver=
bose<br>
&gt; log.<br>
<br>
This really helped. :-)<br>
my .ssh/authorized_keys file looks now like:<br>
from=3D&quot;xxx.xxx.xxx.xxx&quot;,no-<u></u>agent-forwarding,no-port-<u></=
u>forwarding,no-X11-forwarding,<u></u>no-pty,command=3D&quot;distccd --inet=
d&quot; ssh-rsa =E2=80=A6<br>
<br>
This works totally fine for me.<br>
<br>
The problem with a chroot would be, that you would need then a sshd in that=
 chroot as well?<br>
To just encrypt the traffic and have some kind of authentication, a normal =
sshd should do the job as well.<br>
And since the distcc remote user can only execute &quot;distccd --inetd&quo=
t; it should be ok :)<br>
<br>
Thank you very much again!<br>
Regards, Sebastian<br>
<br>
<br>
--<br>
=C2=A0 ,=3D ,-_-. =3D.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/&quot;\<br>
=C2=A0((_/)o o(\_))=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 \ /=C2=A0 =C2=A0 ASCI=
I Ribbon Campaign<br>
=C2=A0 `-&#39;(. .)`-&#39;=C2=A0 =C2=A0&amp;&amp;=C2=A0 =C2=A0 =C2=A0 =C2=
=A0X=C2=A0 =C2=A0 =C2=A0 against HTML e-mail<br>
=C2=A0 =C2=A0 =C2=A0 \_/=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0/ \<br>
<br>
<br>
</blockquote></div>

--001a11c29c9e9103ff05092cd69c--

--===============3697583410530454755==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

__
distcc mailing list            http://distcc.samba.org/
To unsubscribe or change options:
https://lists.samba.org/mailman/listinfo/distcc
--===============3697583410530454755==--