This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
wiki:security:rbash [2014/10/31 20:48] woglinde [secure ssh access] |
wiki:security:rbash [2014/11/01 10:00] woglinde [Security concerns] |
||
---|---|---|---|
Line 1: | Line 1: | ||
- | The way x2go works, allows every user to get a ssh access to the x2go server. | + | The way x2go works, allows every user to get ssh access to the x2go server. |
This can be a big problem when, you can not use the broker, to prevent certain actions on | This can be a big problem when, you can not use the broker, to prevent certain actions on | ||
- | the server. The users can browse the x2go-server and have the access to nearly all directiores. | + | the x2go-server. |
+ | |||
+ | The users can browse the x2go-server and have the access to nearly all directiores. | ||
There are serval options to prevent the user doing it. One would be the use of selinux, but it is hard to understand | There are serval options to prevent the user doing it. One would be the use of selinux, but it is hard to understand | ||
Line 15: | Line 17: | ||
* no redirections via > and >> are allowed | * no redirections via > and >> are allowed | ||
* no calls of binaries via complete path | * no calls of binaries via complete path | ||
- | * no changes | + | * no changes |
But be aware, if rbash detects that a executebale is a shell-script it will be run with full bash. | But be aware, if rbash detects that a executebale is a shell-script it will be run with full bash. | ||
Line 28: | Line 30: | ||
====== secure ssh access ====== | ====== secure ssh access ====== | ||
- | To make sure the users can only access rbash, setup ssh to use **ForceCommand**, | + | To make sure the users can only access rbash, setup ssh to use **ForceCommand**, |
ssh. | ssh. | ||
Therefore edit / | Therefore edit / | ||
- | <note> | + | <code bash> |
Match group rbrowser | Match group rbrowser | ||
ForceCommand sshcommand | ForceCommand sshcommand | ||
- | </note> | + | </code> |
- | ForceCommand only works for a sshd matching section. | + | ForceCommand only works for a sshd matching section. So you can dedicate the rbash to a certain group. |
- | So you can dedicate the rbash to a certain group. | + | |
+ | **sshcommand** is a small shell script to wrap the rbash usage, | ||
+ | |||
+ | <code bash> | ||
+ | #!/bin/sh | ||
+ | PATH=/ | ||
+ | if test -n " | ||
+ | /bin/rbash -c " | ||
+ | else | ||
+ | / | ||
+ | fi | ||
+ | </ | ||
+ | |||
+ | We set the **PATH** to a new directory, so the users can only access the commands from this dir. | ||
+ | |||
+ | ====== Link the needed programs to setup a session ====== | ||
+ | The following programs are needed to link to the new created directory. | ||
+ | |||
+ | <code bash> | ||
+ | / | ||
+ | / | ||
+ | / | ||
+ | / | ||
+ | / | ||
+ | / | ||
+ | / | ||
+ | / | ||
+ | |||
+ | mkdir / | ||
+ | cd / | ||
+ | x2goruncommand, | ||
+ | </ | ||
+ | |||
+ | Because some programs are written in perl and need fragments from the x2go-lib dir and it is searched relative, the lib-directory needs to be linked too. | ||
+ | <code bash> | ||
+ | mkdir / | ||
+ | cd / | ||
+ | </ | ||
+ | |||
+ | ====== Bring the path back to some scripts ====== | ||
+ | Because we set the PATH to / | ||
+ | |||
+ | <code bash> | ||
+ | x2gopath | ||
+ | x2goruncommand | ||
+ | x2gostartagent | ||
+ | x2goterminate-session | ||
+ | </ | ||
+ | |||
+ | After the license header add the following to all files mentioned above | ||
+ | <code bash> | ||
+ | export PATH=/ | ||
+ | </ | ||
+ | |||
+ | ===== Security concerns ===== | ||
+ | There could be still problems to brake out of rbash, no one yet made a security audit of the linked x2go scripts, if they allow the execution of a real shell | ||
+ | via options. | ||
+ | ====== rbash as default shell (optional)====== | ||
+ | |||
+ | If rbash is also set as the default shell via /etc/passwd or some other mechanism, the sessioncleanup skripts needs | ||
+ | to be fixed too. | ||
+ | |||
+ | In | ||
+ | <code bash> | ||
+ | / | ||
+ | </ | ||
+ | |||
+ | the lines with | ||
+ | |||
+ | <code bash> | ||
+ | system(" | ||
+ | </ | ||
+ | |||
+ | needs to be changed to | ||
+ | |||
+ | <code bash> | ||
+ | system(" | ||
+ | </ |