Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add dangerous commands detection feature for subcommand command and script #34

Closed
windvalley opened this issue Jan 9, 2024 · 1 comment
Labels
enhancement New feature or request

Comments

@windvalley
Copy link
Owner

windvalley commented Jan 9, 2024

For security reasons, it is necessary to provide a feature for detecting dangerous commands, and user can customize the command blacklist. If there is no customization, the default blacklist provided by the tool will be used.

The command line:

$ gossh command -h    OR    $ gossh script -h
...
Flags:
...
  -n, --no-safe-check    ignore dangerous commands (from '-B,--run.command-blacklist') check
...
Global Flags:
...
  -B, --run.command-blacklist strings   commands that are prohibited from execution on target hosts
                                        (default: rm,reboot,halt,shutdown,init,mkfs,mkfs.*,umount,dd)
...

Or customize command blacklist in config file:

run:
  # Linux Command Blacklist for gossh subcommands 'command' and 'script'.
  # Commands listed in this blacklist will be prohibited from executing on remote hosts for security reasons.
  # You can add flag '-n, --no-safe-check' to disable this feature.
  # Default: ["rm", "reboot", "halt", "shutdown", "init", "mkfs", "mkfs.*", "umount", "dd"]
  command-blacklist: []
@windvalley windvalley added the enhancement New feature or request label Jan 9, 2024
windvalley added a commit that referenced this issue Jan 9, 2024
Add global flag: `-B, --run.command-blacklist` for specifying dangerous commands.

Default dangerous commands: `["rm", "reboot", "halt", "shutdown", "init", "mkfs", "mkfs.*", "umount", "dd"]`

Add flag `-n, --no-safe-check` for subcommands `command` to disable dangerous commands detection.

Add option `run.command-blacklist` to config file for subcommand `config`.
windvalley added a commit that referenced this issue Jan 10, 2024
Add flag `-n, --no-safe-check` for `script`.
@windvalley
Copy link
Owner Author

This feature has been added to https://github.com/windvalley/gossh/releases/tag/v1.15.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant