RE: ForceCommand executes shell

If you only ever want the user account to perform the one function, overrid=
e their system shell.

example:
oper:x:519:519::/home/oper:/usr/local/bin/oper-only-ever-gets-to-do-this.sh

Regardless of how the account logs in, telnet, ssh, &c they'll only execute=
 that one thing.



________________________________________
From: [email protected] [[email protected]] On Behalf=
 Of Walter de Jong [[email protected]]
Sent: Tuesday, April 19, 2011 8:23 AM
To: [email protected]
Subject: ForceCommand executes shell

Hi,

I have set up a sshd_config that uses an alternate port number and
ForceCommand to force the execution of a home-made service to our users.

ForceCommand executes the command using 'shell' '-c', and as a result
the user's .bashrc, .tcshrc, .whateverrc is being loaded -- which is
something I was trying to prevent, because I'm trying to "force a
command" upon them. In my case loading a .bashrc can be considered as a
security hole.

Is there any way around this? Maybe a different kind of setup would be
better?
I like using ssh for the service because of its excellent authentication
mechanisms.

I even made a patch to sshd session.c (see below) but I'd rather not
have to maintain local mods to the source.


Greets,

     --Walter


void do_child()

/*
    argv[0] =3D (char *) shell0;
    argv[1] =3D "-c";
    argv[2] =3D (char *) command;
    argv[3] =3D NULL;
*/
    argv[0] =3D "/bin/bash";
    argv[1] =3D "--norc";
    argv[2] =3D "--noprofile";
    argv[3] =3D "-c";
    argv[4] =3D (char *)command;
    argv[5] =3D NULL;

    execve(shell, argv, env);
    perror(shell);
    exit(1);


--
                  *** If you build it, they will come ***

HPC Systems Programmer at SARA Computing and Network Services
People should be able to e-mail me, spambots should not.