Re: ipsvd $USER

On Wed, 26 May 2004, Atom 'Smasher' wrote:

> what i'm trying to do: set up an IMAP connection to the server via SSH
> port forward that does not require a manual login. my ssh connection is
> made using ssh-agent/ public-key so i don't have to type a password; it
> knows who i am when i connect.
> 
> let's say i want my desktop MUA to connect to localhost:443 and that
> forwards (via ssh) to remotehost:1234
> 
> i want remotehost to answer on port 1234 with an IMAP server.
> 
> now, if i run (as root) on remotehost:
> 	# /usr/local/sbin/tcpsvd 0 1234 ./test
> then ANY connection to port 1234 executes the "test" script as root.

Which of course is not what you want. Instead, run tcpsvd on 127.0.0.1 on
your local host (presumably secure from hostile connections) and spawn
"setuidgid you ssh ... remotehost imapd ....". Then you'll have your imap
daemon running on the remote host, as you, with all the environment
variables you've previously identified. Depending on what imap daemon you
are using, you'll need to use various tricks (setting extra environment
variables) so that imapd (or its backend) runs pre-authenticated.

> the simple solution doesn't seem to exist, currently: that `tcpsvd` can
> drop to the permissions of the connection being made to it, instead of
> being stuck at the permissions used to invoke the command.

TCP/IP connections don't carry authentication and authorization 
information along with them.

---
Charlie