|
Home > Archive > alt.os.linux > November 2002 > Restricting commands executed by rsh
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
Restricting commands executed by rsh
|
|
| Dirty Harry 2002-11-26, 6:24 pm |
| I have a question about restricting the commands that rsh may execute. First
some background on the situation.
I have two Linux machines, lets call them butch and cassidy. Butch is central
machine (a server in a sense) that several users use via telnet and X
connection. Cassidy is another machine that I and a few others (a subset of
Butch's users) use. Cassidy has a tape drive that we want to make available
to users on Butch for tar dumps and more importantly to allow remote dumps, via
dump, of Butch onto the tape drive.
In reading about tar and its remote writing capability, I've learned that it
uses rsh to do its work. I've turned on the rsh service and created a user
account on cassidy called backup. In backup's home directory I created a
..rhosts file similar to the following
butch.mdomain.com joe
butch.mdomain.com jill
butch.mdomain.com alice
butch.mdomain.com jack
butch.mdomain.com john
Now, from butch I was able to execute a command such as
tar cvf backup@cassidy:/dev/st0 ./directory
and the writing to the tape on cassidy went fine. However, the users listed
above could also do a command such as
rsh -l backup cassidy "cd /proj/frank; ls -al"
and get a directory list. The mode on /proj/frank was 0755. Now my question
is, is it possible to somehow restrict what the users on butch, that do NOT have
an account on cassidy, as to what commands they can do. I know that I could
change the modes on the various directories and files to prevent this.
However, my first choice is to not want to do that since I want other users on
cassidy to have access to these files but not the users on butch. Yes I could
set up groups on cassidy to do this, but all this is a lot more "work" than
I want to do at first just to simply allow users to use the tape drive.
Are there other ways or utilities that could be used to prevent or work around
these problems? I haven't tried the dump command yet and I read that there are
some other issues about rsh and root access since I read somewhere that only
root can do remote dump backups.
| |
| Peter T. Breuer 2002-11-27, 2:24 am |
| In alt.os.linux Dirty Harry <dirty.harry@juno.com> wrote:
> Now, from butch I was able to execute a command such as
> tar cvf backup@cassidy:/dev/st0 ./directory
> and the writing to the tape on cassidy went fine. However, the users listed
> above could also do a command such as
> rsh -l backup cassidy "cd /proj/frank; ls -al"
This implies to me that you really used ssh instead of rsh? Which is
good.
> and get a directory list. The mode on /proj/frank was 0755. Now my question
> is, is it possible to somehow restrict what the users on butch, that do NOT have
> an account on cassidy, as to what commands they can do. I know that I could
They will be restricted exactly by what the account called "backup" can do.
> change the modes on the various directories and files to prevent this.
> However, my first choice is to not want to do that since I want other users on
> cassidy to have access to these files but not the users on butch. Yes I could
> set up groups on cassidy to do this, but all this is a lot more "work" than
> I want to do at first just to simply allow users to use the tape drive.
The simplest thing would be to use /home/backup/.ssh/rc as some kind
of command filter. See if it gets any arguments. I know it gets
a cookie on standard input.
> Are there other ways or utilities that could be used to prevent or work around
You would have to change the sshd/rshd.
Peter
|
|
|
|
|