Differences

This shows you the differences between two versions of the page.

--- wiki:security:rbash [2014/11/01 09:23]
woglinde
+++ wiki:security:rbash [2014/11/01 10:00]
woglinde [Security concerns]
@@ Line 17: / Line 17: @@
   * no redirections via > and >> are allowed
   * no calls of binaries via complete path
-  * no changes on the PATH variable are allowed
+  * no changes off the PATH variable are allowed
 But be aware, if rbash detects that a executebale is a shell-script it will be run with full bash.
@@ Line 93: / Line 93: @@
 </code>
+===== Security concerns =====
+There could be still problems to brake out of rbash, no one yet made a security audit of the linked x2go scripts, if they allow the execution of a real shell
+via options.
 ====== rbash as default shell (optional)======
@@ Line 98: / Line 101: @@
 to be fixed too.
+In
+<code bash>
+/usr/sbin/x2gocleansessions
+</code>
+the lines with
+<code bash>
+system("su", "@sinfo[11]", "-c"
+</code>
+needs to be changed to
+<code bash>
+system("su", "@sinfo[11]", "-s", "/bin/bash", "-c",
+</code>

X2Go - everywhere@home