search

ghantoos / lshell

lshell is a shell coded in Python, that lets you restrict a user's environment to limited sets of commands, choose to enable/disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restriction, and more.
GNU General Public License v3.0
435 stars 112 forks source link

sudo over ssh #136

Open berzia opened 8 years ago

berzia commented 8 years ago

Hi,

I want to run this command over ssh "sudo pw userdel user" and when I try, lshell return "*\ forbidden shell escape". Can you help me pls ?

PS : shell.conf allowed : 'all' - ['sh','czh','chpass'] sudo_commands : all overssh : ['grep', 'cut', 'uname', 'sudo', 'pw']

Have a nice day.

Berzia

ghantoos commented 8 years ago

Hello,

It looks like the pw command is using exec call, which are intercepted by lshell. I am not sure what is pw, can you tell me what hides behind it?

berzia commented 8 years ago

Hi,

Thanks for your answer.

pw is used to manage accounts (users and groups) on FreeBSD. I try to delete an user with a ssh script. ( https://www.freebsd.org/cgi/man.cgi?pw%288%29)

I have an other problem, when I try to start a daemon like this : /usr/local/etc/rc.d/example start, lshell returns "forbidden command". I don't know if I miss something or if it's a bug.

bye

ghantoos commented 8 years ago

Have you tried adding pw(8) to the allowed list?

About the daemons, you will need to add /usr/local/etc/rc.d/ to the path of your user in order not to get rejected for "forbidden path". Then add "/usr/local/etc/rc.d/example" to the allowed list.

ghantoos commented 8 years ago

You can also use allowed_cmd_path: ['/usr/local/etc/rc.d/'] then add example to your allowed list.