Re: How to enforce "user cannot invoke any programs without first logging on to the system"
- From: comphelp@xxxxxxxxx (Todd H.)
- Date: 12 Jun 2006 15:03:17 -0500
"James" <jzheng22@xxxxxxxxx> writes:
I posted the question on comp.unix.admin, then I realized there is
a unix security group, so I repost here. Thanks.
Hi all,
I am writing shell scripts to enforce some security standards. One
of the rules is "Users cannot get access to shell or invoke any other
programs without first logging on to the system"
This looks simple, but there's a lot to it. On one hand, it should be
automatic... you can't do anything on unix without first logging in.
However, poorly secured webservers, for instance, can allow someone to
run commands without logging in certain circumstances. So the larger
goal of keeping all running network apps up to date with secure
versions is very important, as is having any custom code audited for
security.
Does this mean
echo "mkdir /tmp/testdir" | ssh userid@anothermachine
should be prohibited?
No. All that does is makes a directory on the local machine and
pipes the output to a shell on anothermachine. Depending on
anothermachine's sshd conf file settings, a password should be
prompted for. If not, then public key auth has been enabled and
configured. Better to look for public key files on the file system
with find and to audit sshd_config files for allowing such things if
you need to enforce that policy without exception.
How to enforce such kind of security rule? Is there ssh configuration
I should take a look at?
Yes. Typically in /etc/ssh/sshd_config
RSAAuthentication
PubkeyAuthentication settings will be of interest.
Also, you'll want to look for .rhosts files around and whether
rcommands work... There's a lot of configuration stuff to check
actually.
--
Todd H.
http://www.toddh.net/
.
- Follow-Ups:
- References:
- Prev by Date: How to enforce "user cannot invoke any programs without first logging on to the system"
- Next by Date: Re: How to enforce "user cannot invoke any programs without first logging on to the system"
- Previous by thread: How to enforce "user cannot invoke any programs without first logging on to the system"
- Next by thread: Re: How to enforce "user cannot invoke any programs without first logging on to the system"
- Index(es):
Relevant Pages
|
Loading
