Re: ForceCommand executes shell

Hi,

This works, but ruins the possiblity of having a normal shell on the
standard port 22.

Another note, if you want the possibility of letting the user specify
any command-line arguments, oper-only-ever-gets-to-do-this.sh should
accept the '-c' argument as sshd executes 'shell' '-c'.

Something else, I noticed that an scp also triggers the execution of
~/.bashrc and ~/.ssh/rc on the remote side. Isn't this odd?


Greets,

    --Walter


On 04/20/2011 05:25 PM, Males, Jess wrote:
> If you only ever want the user account to perform the one function, ove=
rride their system shell.
>=20
> example:
> oper:x:519:519::/home/oper:/usr/local/bin/oper-only-ever-gets-to-do-thi=
s.sh
>=20
> Regardless of how the account logs in, telnet, ssh, &c they'll only exe=
cute that one thing.
>=20
>=20
>=20
> ________________________________________
> From: [email protected] [[email protected]] On Be=
half Of Walter de Jong [[email protected]]
> Sent: Tuesday, April 19, 2011 8:23 AM
> To: [email protected]
> Subject: ForceCommand executes shell
>=20
> Hi,
>=20
> I have set up a sshd_config that uses an alternate port number and
> ForceCommand to force the execution of a home-made service to our users=
.
>=20
> ForceCommand executes the command using 'shell' '-c', and as a result
> the user's .bashrc, .tcshrc, .whateverrc is being loaded -- which is
> something I was trying to prevent, because I'm trying to "force a
> command" upon them. In my case loading a .bashrc can be considered as a
> security hole.
>=20
> Is there any way around this? Maybe a different kind of setup would be
> better?
> I like using ssh for the service because of its excellent authenticatio=
n
> mechanisms.
>=20
> I even made a patch to sshd session.c (see below) but I'd rather not
> have to maintain local mods to the source.
>=20
>=20
> Greets,
>=20
>      --Walter
>=20
>=20
> void do_child()
>=20
> /*
>     argv[0] =3D (char *) shell0;
>     argv[1] =3D "-c";
>     argv[2] =3D (char *) command;
>     argv[3] =3D NULL;
> */
>     argv[0] =3D "/bin/bash";
>     argv[1] =3D "--norc";
>     argv[2] =3D "--noprofile";
>     argv[3] =3D "-c";
>     argv[4] =3D (char *)command;
>     argv[5] =3D NULL;
>=20
>     execve(shell, argv, env);
>     perror(shell);
>     exit(1);
>=20
>=20
> --
>                   *** If you build it, they will come ***
>=20
> HPC Systems Programmer at SARA Computing and Network Services
> People should be able to e-mail me, spambots should not.

--=20
                  *** If you build it, they will come ***

HPC Systems Programmer at SARA Computing and Network Services
People should be able to e-mail me, spambots should not.