Re: Secure remote shell

On Nov 29, 2007, at 1:37 AM, Steve Bertrand wrote:

[snip]

A legitimate question:

If I add user 'www' to 'sudoers' with the ability to run adduser, does
that not give user 'www' to put the added user in a group, perhaps wheel?

If said commands are passed via 'user' to web browser to web server, run
within context of the web server user, and web server user has sudo
rights to the remote box, does that not mean that the server is
essentially 'executing user input'?


Not if you use the right commands and configure the sudo stuff correctly. Since this is scripted, you can easily force a very specific set of commands on the script, and specifically omit the groups you do not want.

man sudo is your friend.
-----
Eric F Crist
Secure Computing Networks


_______________________________________________
freebsd-questions@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: a little more help with python server-side scripting
    ... I presume you can log in to your web server using ssh or telnet or similar. ... to make the script executable, and therefore recognised as a proper script by Apache. ... The way I log into my server space is by an FTP program, so I don't see an occasion to actually *type* in any kind of commands. ...
    (comp.lang.python)
  • Re: Secure remote shell
    ... - have web server save information to server disk in non-executable format ... have script authenticate/authorize commands to be performed ... (recommend doing this manually for a while to ensure you capture as many ...
    (freebsd-questions)
  • Re: trouble compiling Midnight Commander
    ... to get the file manager Midnight Commander running on my Mac Pro. ... first tried the Fink version, but that was essentially useless, so now ... sudo commands. ... I issued 'sudo make install' as the last of the commands listed ...
    (comp.sys.mac.apps)
  • Re: Web Help
    ... And save it as "certificate.php" on your web server. ... do to get around the limitations with IWP reports is to build your own. ... and the "Go to URL" script step. ... Printing from the web is not the best as you can not compress ...
    (comp.databases.filemaker)
  • Script using dll and ocx (to integrate in IIS )
    ... I have a script for an Motion Jpeg that I have to integrate into a website ... to get a "live Image" from a network camera. ... But in this script I have to install a dll and an oxc on my ... Create a Web Server alias and use this as the image ...
    (microsoft.public.inetserver.iis.ftp)