search

ghantoos / lshell

lshell is a shell coded in Python, that lets you restrict a user's environment to limited sets of commands, choose to enable/disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restriction, and more.
GNU General Public License v3.0
436 stars 112 forks source link

lshell and cpanel #116

Closed lmarkov closed 8 years ago

lmarkov commented 8 years ago

Hello, I make tests using lshell on server with cPanel. I want to use all cPanel scripts. For example:

/usr/local/cpanel/scripts
/scripts

I set this paths in allowed_cmd_path but this does't work. Can you give me a suggestion?

The same problem is with dir /usr/local/apache/bin for example.

lmarkov commented 8 years ago

I saw that evething works but there is no need to write /scripts in front of the script name as usual.

ghantoos commented 8 years ago

:+1:

lmarkov commented 8 years ago

Hello, I try to add scripts from /etc/init.d/ but when I added this directory or the full path /etc/rc.d/init.d to allowed_cmd_path there is no result.

The only way I can execute a script from this location is to add the name of the script into allowed commands and put alias to 'command':'/etc/rc.d/init.d/command'.

Can you suggest me another solution?

ghantoos commented 8 years ago

@lmarkov adding /etc/rc.d/init.d will make all the commands located in this folder available, without the /etc/rc.d/init.d appended. For example: /etc/rc.d/init.d/openvpn start, becomes openvpn start.

Otherwise, you will have to add the script full paths in the allowed list. This will need to be done one-by-one.

ghantoos commented 8 years ago

@lmarkov I'm closing this issue, please reopen it if the answer above is not what you were looking for.

lmarkov commented 8 years ago

I made a test and everything looks like you said but for example:

:~$ cdp-agent status
lshell: status: No such file or directory

If I add alias 

'cdp-agent':'/etc/rc.d/init.d/cdp-agent'

it works:

:~$ cdp-agent status
/etc/rc.d/init.d/cdp-agent status: cdp (pid 6734) running
ghantoos commented 8 years ago

I was not able to reproduce your bug:

ghantoos:~$ networking
Usage: /etc/init.d/networking {start|stop|reload|restart|force-reload}

This invokes /etc/init.d/networking start.

Good to know that the alias corrects your use-cases. Thanks for sharing this.