Differences

This shows you the differences between two versions of the page.

--- wiki:security:rbash [2014/10/31 20:42]
woglinde [secure ssh access]
+++ wiki:security:rbash [2014/11/03 13:07] (current)
woglinde [rbash as default shell (optional)]
@@ Line 1: / Line 1: @@
-The way x2go works, allows every user to get a ssh access to the x2go server.
+The way x2go works, allows every user to get ssh access to the x2go server.
 This can be a big problem when, you can not use the broker, to prevent certain actions on
-the server. The users can browse the x2go-server and have the access to nearly all directiores.
+the x2go-server.
+The users can browse the x2go-server and have the access to nearly all directiores.
 There are serval options to prevent the user doing it. One would be the use of selinux, but it is hard to understand
 and hard to setup correctly. Another option is the use of rbash, but with the current state of x2go-server there
 are serval steps so setup it up working correctly.
+This guide is focused on a single application approach, no audio, remote/mounted dirs and printing are involved.
 ====== rbash short feature overview ======
@@ Line 15: / Line 19: @@
   * no redirections via > and >> are allowed
   * no calls of binaries via complete path
-  * no changes on the PATH variable are allowed
+  * no changes off the PATH variable are allowed
 But be aware, if rbash detects that a executebale is a shell-script it will be run with full bash.
@@ Line 28: / Line 32: @@
 ====== secure ssh access ======
-To make sure the users can only access rbash, setup ssh to use **ForceCommand**
+To make sure the users can only access rbash, setup ssh to use **ForceCommand**, otherwise the users can run any other shells or commands over
+ssh.
+Therefore edit /etc/ssh/sshd_config and put the the following lines at the end.
+<code bash>
+    Match group rbrowser
+        ForceCommand sshcommand
+</code>
+ForceCommand only works for a sshd matching section. So you can dedicate the rbash to a certain group.
+**sshcommand** is a small shell script to wrap the rbash usage,
+<code bash>
+#!/bin/sh
+PATH=/opt/rbash/bin
+if test -n "$SSH_ORIGINAL_COMMAND"; then
+    /bin/rbash -c "$SSH_ORIGINAL_COMMAND"
+else
+    /bin/rbash
+fi
+</code>
+We set the **PATH** to a new directory, so the users can only access the commands from this dir.
+====== Link the needed programs to setup a session ======
+The following programs are needed to link to the new created directory.
+<code bash>
+/usr/bin/setsid
+/usr/bin/whoami
+/usr/bin/x2goagent
+/usr/bin/x2golistsessions
+/usr/bin/x2gopath
+/usr/bin/x2goruncommand
+/usr/bin/x2gostartagent
+/usr/bin/x2goterminate-session
+mkdir /opt/rbash/bin
+cd /opt/rbash/bin && ln -s /usr/bin/{setsid,whoami,x2goagent,x2golistsessions,x2gopath,\
+x2goruncommand,x2gostartagent,x2goterminate-session} .
+</code>
+Because some programs are written in perl and need fragments from the x2go-lib dir and it is searched relative, the lib-directory needs to be linked too.
+<code bash>
+mkdir /opt/rbash/lib
+cd /opt/rbash/lib && ln -s /usr/lib/x2go .
+</code>
+====== Bring the path back to some scripts ======
+Because we set the PATH to /opt/rbash/bin some scripts needs to set it back to be functional again.
+<code bash>
+x2gopath
+x2goruncommand
+x2gostartagent
+x2goterminate-session
+</code>
+After the license header add the following to all files mentioned above
+<code bash>
+export PATH=/bin:/usr/bin:/sbin:/usr/sbin
+</code>
+===== Security concerns =====
+There could be still problems to brake out of rbash, no one yet made a security audit of the linked x2go scripts, if they allow the execution of a real shell
+via options.

X2Go - everywhere@home

User Tools

Site Tools

Differences

Page Tools