ClearML/dropbear
1
0
Fork 0
mirror of https://github.com/clearml/dropbear synced 2025-03-03 18:52:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

- set $SSH_ORIGINAL_COMMAND if a command is forced, and log it

Browse Source 
if LOG_COMMANDS is set

--HG--
extra : convert_revision : d9e8aa0ecbe7607285fa4f96f0d6f9b1523719d8
This commit is contained in:
Matt Johnston 2009-08-26 14:09:22 +00:00
parent 0b50010436
commit 4b1f9e50f2
4 changed files with 30 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
auth.h
View File

@ -99,7 +99,6 @@ void cli_auth_pubkey_cleanup();
* relatively little extraneous bits when used for the client rather than the * relatively little extraneous bits when used for the client rather than the
* server */ * server */
struct AuthState { struct AuthState {
char *username; /* This is the username the client presents to check. It char *username; /* This is the username the client presents to check. It
is updated each run through, used for auth checking */ is updated each run through, used for auth checking */
unsigned char authtypes; /* Flags indicating which auth types are still unsigned char authtypes; /* Flags indicating which auth types are still
@ -122,7 +121,6 @@ struct AuthState {
#ifdef ENABLE_SVR_PUBKEY_OPTIONS #ifdef ENABLE_SVR_PUBKEY_OPTIONS
struct PubKeyOptions* pubkey_options; struct PubKeyOptions* pubkey_options;
#endif #endif
}; };
#ifdef ENABLE_SVR_PUBKEY_OPTIONS #ifdef ENABLE_SVR_PUBKEY_OPTIONS
@ -135,7 +133,7 @@ struct PubKeyOptions {
int no_pty_flag; int no_pty_flag;
/* "command=" option. */ /* "command=" option. */
unsigned char * forced_command; unsigned char * forced_command;
unsigned char * original_command;
}; };
#endif #endif

3
options.h
View File

@ -172,7 +172,8 @@ much traffic. */
/*#define ENABLE_SVR_PAM_AUTH*/ /*#define ENABLE_SVR_PAM_AUTH*/
#define ENABLE_SVR_PUBKEY_AUTH #define ENABLE_SVR_PUBKEY_AUTH
/* Wether to ake public key options in authorized_keys file into account */ /* Whether to take public key options in
* authorized_keys file into account */
#ifdef ENABLE_SVR_PUBKEY_AUTH #ifdef ENABLE_SVR_PUBKEY_AUTH
#define ENABLE_SVR_PUBKEY_OPTIONS #define ENABLE_SVR_PUBKEY_OPTIONS
#endif #endif

15
svr-authpubkeyoptions.c
View File

@ -88,10 +88,20 @@ int svr_pubkey_allows_pty() {
return 1; return 1;
} }
/* Set chansession command to the one forced by 'command' public key option */ /* Set chansession command to the one forced
* by any 'command' public key option. */
void svr_pubkey_set_forced_command(struct ChanSess *chansess) { void svr_pubkey_set_forced_command(struct ChanSess *chansess) {
if (ses.authstate.pubkey_options) if (ses.authstate.pubkey_options) {
ses.authstate.pubkey_options->original_command = chansess->cmd;
if (!chansess->cmd)
{
ses.authstate.pubkey_options->original_command = m_strdup("");
}
chansess->cmd = ses.authstate.pubkey_options->forced_command; chansess->cmd = ses.authstate.pubkey_options->forced_command;
#ifdef LOG_COMMANDS
dropbear_log(LOG_INFO, "command forced to '%s'", ses.authstate.pubkey_options->original_command);
#endif
}
} }
/* Free potential public key options */ /* Free potential public key options */
@ -124,7 +134,6 @@ int svr_add_pubkey_options(buffer *options_buf, int line_num, const char* filena
TRACE(("enter addpubkeyoptions")) TRACE(("enter addpubkeyoptions"))
ses.authstate.pubkey_options = (struct PubKeyOptions*)m_malloc(sizeof( struct PubKeyOptions )); ses.authstate.pubkey_options = (struct PubKeyOptions*)m_malloc(sizeof( struct PubKeyOptions ));
memset(ses.authstate.pubkey_options, '\0', sizeof(*ses.authstate.pubkey_options));
buf_setpos(options_buf, 0); buf_setpos(options_buf, 0);
while (options_buf->pos < options_buf->len) { while (options_buf->pos < options_buf->len) {

18
svr-chansession.c
View File

@ -578,6 +578,7 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
int iscmd, int issubsys) { int iscmd, int issubsys) {
unsigned int cmdlen; unsigned int cmdlen;
int is_forced;
int ret; int ret;
TRACE(("enter sessioncommand")) TRACE(("enter sessioncommand"))
@ -589,9 +590,6 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
return DROPBEAR_FAILURE; return DROPBEAR_FAILURE;
} }
/* take public key option 'command' into account */
svr_pubkey_set_forced_command(chansess);
if (iscmd) { if (iscmd) {
/* "exec" */ /* "exec" */
if (chansess->cmd == NULL) { if (chansess->cmd == NULL) {
@ -616,6 +614,9 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
} }
} }
} }
/* take public key option 'command' into account */
svr_pubkey_set_forced_command(chansess);
#ifdef LOG_COMMANDS #ifdef LOG_COMMANDS
if (chansess->cmd) { if (chansess->cmd) {
@ -883,6 +884,17 @@ static void execchild(void *user_data) {
addnewvar("TERM", chansess->term); addnewvar("TERM", chansess->term);
} }
printf("adding option %p %s\n", ses.authstate.pubkey_options,
ses.authstate.pubkey_options->original_command);
#ifdef ENABLE_SVR_PUBKEY_OPTIONS
if (ses.authstate.pubkey_options &&
ses.authstate.pubkey_options->original_command) {
addnewvar("SSH_ORIGINAL_COMMAND",
ses.authstate.pubkey_options->original_command);
}
#endif
/* change directory */ /* change directory */
if (chdir(ses.authstate.pw_dir) < 0) { if (chdir(ses.authstate.pw_dir) < 0) {
dropbear_exit("error changing directory"); dropbear_exit("error changing directory");