Date: Sun, 14 Oct 2001 20:42:20 -0700 From: "Crist J. Clark" <cristjc@earthlink.net> To: Francisco Reyes <lists@natserv.com> Cc: FreeBSD Questions List <questions@FreeBSD.ORG> Subject: Re: Automating ssh connections so only one command would run. Message-ID: <20011014204220.K309@blossom.cjclark.org> In-Reply-To: <20011014225334.V18306-100000@zoraida.natserv.net>; from lists@natserv.com on Sun, Oct 14, 2001 at 10:58:27PM -0400 References: <20011012222025.I6274@blossom.cjclark.org> <20011014225334.V18306-100000@zoraida.natserv.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Oct 14, 2001 at 10:58:27PM -0400, Francisco Reyes wrote:
> > > >it is trivial to slip commands through scp(1),
> > > >$ scp 'remote:somefile;touch /tmp/scp_test' .
> > > > And check for /tmp/scp_test on the remote machine.
> > > I don't see how this is a security problem. Could you explain?
> >
> > I presume you want to limit people to scp(1) so they do not have full
> > shell access; they can't execute arbitrary commands on the remote
> > machine. With scp(1), you can do,
> >
> > $ cat > command.sh <<EOF
> > > exec > command.out 2>&1
> > > <put your arbitrary commands here>
> > > EOF
> > $ scp command.sh remote:
> > $ scp 'remote:nonexistent; /bin/sh command.sh' .
> > $ scp remote:command.out .
> > $ more command.out
>
> I just did what you wrote above. All a person would be able to do is to
> copy the command.sh file/command to the other machine. If I could limit
> their ability to only run scp and not ssh there would be no harm (in my
> setup) just by been able to copy arbitrary files. Of course I still need
> to have a quota so they don't override the space on the other machine, but
> that is not all too much trouble.
But scp(1) IS ssh(1). scp(1) is just a wrapper around ssh(1) to copy
files. When you run scp(1) on the local machine, it calls the ssh(1)
executable on the local machine, connects to the sshd daemon on the
otherside which then runs a shell with scp(1) as the program the shell
is to run.
> > > Automating scp may not be the most secure way to copy data, but is there a
> > > better way?
> > scp = ssh = shell access. But I may have misunderstood what you are
> > trying to achieve.
>
> I am just trying to copy 2 files every day from one machine to another.
Oh. That's all? No isssues with untrusted users. I did misunderstand.
For example, we want to copy 'file1' and 'file2' from 'src-machine'
to the directory '/dir/path' on 'dst-machine.' On the remote machine,
put,
from="source-machine",no-pty,command="cd /dir/path; tar xf -" <rest
of key>
In front of the 'authorized_key' entry. On the src-machine, just run,
$ tar cf - file1 file2 | ssh dst-machine
To move the files. You may wish to use a dedicated key for this
operation. Use the '-i' option to specify the key at the source end.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011014204220.K309>