wiki:security:rbash
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
wiki:security:rbash [2014/10/31 21:01] woglinde [secure ssh access] |
wiki:security:rbash [2014/11/03 13:07] (current) woglinde [rbash as default shell (optional)] |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | The way x2go works, allows every user to get a ssh access to the x2go server. | + | The way x2go works, allows every user to get ssh access to the x2go server. |
| This can be a big problem when, you can not use the broker, to prevent certain actions on | This can be a big problem when, you can not use the broker, to prevent certain actions on | ||
| - | the server. The users can browse the x2go-server and have the access to nearly all directiores. | + | the x2go-server. |
| + | |||
| + | The users can browse the x2go-server and have the access to nearly all directiores. | ||
| There are serval options to prevent the user doing it. One would be the use of selinux, but it is hard to understand | There are serval options to prevent the user doing it. One would be the use of selinux, but it is hard to understand | ||
| and hard to setup correctly. Another option is the use of rbash, but with the current state of x2go-server there | and hard to setup correctly. Another option is the use of rbash, but with the current state of x2go-server there | ||
| are serval steps so setup it up working correctly. | are serval steps so setup it up working correctly. | ||
| + | |||
| + | This guide is focused on a single application approach, no audio, remote/ | ||
| ====== rbash short feature overview ====== | ====== rbash short feature overview ====== | ||
| Line 15: | Line 19: | ||
| * no redirections via > and >> are allowed | * no redirections via > and >> are allowed | ||
| * no calls of binaries via complete path | * no calls of binaries via complete path | ||
| - | * no changes | + | * no changes |
| But be aware, if rbash detects that a executebale is a shell-script it will be run with full bash. | But be aware, if rbash detects that a executebale is a shell-script it will be run with full bash. | ||
| Line 49: | Line 53: | ||
| fi | fi | ||
| </ | </ | ||
| + | |||
| + | We set the **PATH** to a new directory, so the users can only access the commands from this dir. | ||
| + | |||
| + | ====== Link the needed programs to setup a session ====== | ||
| + | The following programs are needed to link to the new created directory. | ||
| + | |||
| + | <code bash> | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | |||
| + | mkdir / | ||
| + | cd / | ||
| + | x2goruncommand, | ||
| + | </ | ||
| + | |||
| + | Because some programs are written in perl and need fragments from the x2go-lib dir and it is searched relative, the lib-directory needs to be linked too. | ||
| + | <code bash> | ||
| + | mkdir / | ||
| + | cd / | ||
| + | </ | ||
| + | |||
| + | ====== Bring the path back to some scripts ====== | ||
| + | Because we set the PATH to / | ||
| + | |||
| + | <code bash> | ||
| + | x2gopath | ||
| + | x2goruncommand | ||
| + | x2gostartagent | ||
| + | x2goterminate-session | ||
| + | </ | ||
| + | |||
| + | After the license header add the following to all files mentioned above | ||
| + | <code bash> | ||
| + | export PATH=/ | ||
| + | </ | ||
| + | |||
| + | ===== Security concerns ===== | ||
| + | There could be still problems to brake out of rbash, no one yet made a security audit of the linked x2go scripts, if they allow the execution of a real shell | ||
| + | via options. | ||
| + | |||
wiki/security/rbash.1414789289.txt.gz · Last modified: 2014/10/31 21:01 by woglinde
Imprint & Legal Disclaimer -
Data Protection & Privacy Statement
Except where otherwise noted, content on this wiki is licensed under the following license: GNU Free Documentation License 1.3