-
Notifications
You must be signed in to change notification settings - Fork 4
/
index.html
196 lines (196 loc) · 6.1 KB
/
index.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
<!doctype html public "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-type" content="text/html; charset=US-ASCII">
<meta name="author" content="raf ([email protected])">
<meta name="modified" content="TIMESTAMP">
<meta name="description" content="sshdo - controls which commands may be executed via incoming ssh">
<meta name="keywords" content="ssh, authorized_keys, command, control">
<title>sshdo</title>
<style type="text/css">
<!--
body { color: #000; background-color: #fff; }
a:link { color: #00c; }
a:visited { color: #66c; }
a:active { color: #c00; }
.center { text-align: center; }
.right { text-align: right; }
.larger { font-size: larger; }
-->
</style>
</head>
<body>
<div class="center">
<h1><a href="https://raf.org/sshdo">sshdo</a></h1>
<p>
<span class="larger">
controls which commands may be executed via incoming ssh
</span>
<br>
<br>
</p>
</div>
<hr>
<div class="center">
<a href="#what_is_sshdo">What is sshdo?</a>
| <a href="#supported_platforms">Supported Platforms</a>
| <a href="#documentation">Documentation</a>
| <a href="#download">Download</a>
</div>
<hr>
<h2><a name="what_is_sshdo">What is sshdo?</a></h2>
<p>
<em>sshdo</em> provides an easily configurable way of controlling which
commands may be executed via incoming <em>ssh</em> connections.
</p>
<p>
An <em>ssh</em> public key in a <code>~/.ssh/authorized_keys</code> file
can have a <code>command=""</code> option which forces a particular command
to be executed when the key is used to authenticate an <em>ssh</em>
connection. This is a security control that mitigates against private key
compromise.
</p>
<p>
This is great when you only need to execute a single command. But if you
need to perform multiple tasks, you would normally need to create and
install a separate key pair for each command, or just not bother making use
of forced commands and allow the key to be used to execute any command.
</p>
<p>
Instead, you can make <em>sshdo</em> act as the forced command, and when an
<em>ssh</em> connection tries to execute a command, <em>sshdo</em> will
consult the configuration files, <code>/etc/sshdoers</code> and
<code>/etc/sshdoers.d/*</code>, to decide whether or not the user and key
are allowed to execute the command. The requested command is only executed
if it is allowed by the configuration.
</p>
<p>
This makes it possible to use a single authorized key for any number of
commands and still prevent its use for any other purpose.
</p>
<p>
You will need to identify which commands need to be allowed by each user and
authorized key. To make this easy, <em>sshdo</em> can be put into
<em>training</em> mode where it will allow (and log) the exeution of all
commands.
</p>
<p>
After some time, <em>sshdo</em> can then <em>learn</em> from the logs and
create the configuration necessary to allow the commands that were
encountered during training mode.
</p>
<p>
It can also <em>unlearn</em> occasionally and create a new configuration
that will no longer allow commands that no longer appear to be in use. This
can help to maintain strict least privilege.
</p>
<p>
<em>sshdo</em> is freely available under the
<a href="https://www.gnu.org/licenses">GNU General Public License Version 2 or later</a>.
</p>
<h2><a name="supported_platforms">Supported Platforms</a></h2>
<p>
<em>sshdo</em> is written in <em>Python</em> (2.6+ or 3.3+) and should run
on most systems. It assumes POSIX and an <em>SSH</em> server and a
<em>syslog</em>-compatible logging system.
</p>
<h2><a name="documentation">Documentation</a></h2>
<p>
There is a README file etc., and two manual pages:
</p>
<table>
<tr valign="top">
<td align="right"><a href="README.md">README.md</a></td>
<td>-</td>
<td>Description</td>
</tr>
<tr valign="top">
<td align="right"><a href="INSTALL">INSTALL</a></td>
<td>-</td>
<td>Installation, Requirements</td>
</tr>
<tr valign="top">
<td align="right"><a href="COPYING">COPYING</a></td>
<td>-</td>
<td>Licence information</td>
</tr>
<tr valign="top">
<td align="right"><a href="CHANGELOG">CHANGELOG</a></td>
<td>-</td>
<td>History</td>
</tr>
<tr valign="top">
<td align="right"><a href="manual/sshdo.8.html"><code>sshdo(8)</code></a></td>
<td>-</td>
<td>controls which commands may be executed via incoming ssh (<a href="sources/sshdo">source</a>)</td>
</tr>
<tr valign="top">
<td align="right"><a href="manual/sshdoers.5.html"><code>sshdoers(5)</code></a></td>
<td>-</td>
<td>configuration file for <em>sshdo(8)</em></td>
</tr>
</table>
<h2><a name="download">Download</a></h2>
<table>
<tr valign="top">
<td align="right">
Latest:
</td>
<td align="left">
<a href="download/sshdo-1.1.1.tar.gz"><code>sshdo-1.1.1.tar.gz</code></a>
</td>
<td align="left">
(<code>SHA256 9b22e14fec786b692e8d6431a81e9b17ad8f6e62ae5d6ef9e9c643690bf33f90</code>)
</td>
</tr>
<tr>
<td> </td>
<td> </td>
<td> </td>
</tr>
<tr valign="top">
<td align="right" rowspan="3">
Previous:
</td>
<td align="left">
<a href="download/sshdo-1.1.tar.gz"><code>sshdo-1.1.tar.gz</code></a>
</td>
<td align="left">
(<code>SHA256 04a36696538ddbf188f86c357c1d2eaca21b2a09dd555bae072ed8660400c75a</code>)
</td>
</tr>
<tr valign="top">
<td align="left">
<a href="download/sshdo-1.0.tar.gz"><code>sshdo-1.0.tar.gz</code></a>
</td>
<td align="left">
(<code>SHA256 ce776dd9481bebf14127a58e2c5809f802097bafbf36a1436bf2bf053fc327ab</code>)
</td>
</tr>
<tr valign="top">
<td align="left">
<a href="download/sshdo-0.1.tar.gz"><code>sshdo-0.1.tar.gz</code></a>
</td>
<td align="left">
(<code>SHA256 6f0e210db84473b3c459c13c75843a0ee28751b6e342ae18bccf8dc840400213</code>)
</td>
</tr>
</table>
<hr>
<div class="center">
<a href="#what_is_sshdo">What is sshdo?</a>
| <a href="#supported_platforms">Supported Platforms</a>
| <a href="#documentation">Documentation</a>
| <a href="#download">Download</a>
</div>
<hr>
<div>
Last modified by <a href="mailto:[email protected]">raf</a> at
TIMESTAMP
</div>
<div class="right">
<a href="https://validator.w3.org/check?url=https://raf.org/sshdo">v</a>
<a href="https://jigsaw.w3.org/css-validator/validator?uri=https://raf.org/sshdo">v</a>
</div>
</body>
</html>