ghantoos / lshell

lshell is a shell coded in Python, that lets you restrict a user's environment to limited sets of commands, choose to enable/disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restriction, and more.
GNU General Public License v3.0
435 stars 112 forks source link

comand failed when arguments has the forbidden keywords #121

Closed jenningsloy318 closed 8 years ago

jenningsloy318 commented 8 years ago

I encountered a issue, we set the 'rm' command forbidden , when we issued command which contain "rm", will be kicked off.

$ cd rma_push_status *\ forbidden syntax -> "cd rma_push_status"

ghantoos commented 8 years ago

The "forbidden" variable contains forbidden characters/strings, which will match your file name in this case.

Why do you need to put it in the "forbidden", you can just not add it to the "allowed". All the other commands are automatically forbidden.

Does this help?

jenningsloy318 commented 8 years ago

You mean that if it is not in allowed list, it can be forbidden to execute? Thank you, I will have a try.

ghantoos commented 8 years ago

Yes, if a command is not in the allowed list, then it is forbidden.

jenningsloy318 commented 8 years ago

Tested it. it is working now, thanks.

tealord commented 5 years ago

In my case '&' needs to be a parameter and since it is in default configuration forbidden my command fails:

user:~$ echo foo foo user:~$ echo 'foo' foo user:~$ echo 'foo&' *** forbidden syntax -> "echo 'foo&'" *** You have 98 warning(s) left, before getting kicked out. This incident has been reported.

Removing '&' from the forbidden character list does not help because it is interpreted to execute the next command, even if its single quoted. Do you have a solution for this? Thank you very much!