I disagree, it's a security risk. Attackers can and will get root access from elevated permissions with ssh/telnet/shell access. If you are going to be choosing non-smart security practices, I want it to be an affirmative action on your part.
In fact this is bad enough I suggest that we roll a new release immediately with this. donald On Wed, Aug 19, 2015 at 5:55 PM, Martin Winter < [email protected]> wrote: > I would prefer the default for configure to be the same as now > (= unrestricted). > > So rather have an option for “—disable-shell-access” and have the > default to be as it is today. > > - Martin > > > On 12 Aug 2015, at 16:37, Donald Sharp wrote: > > Restrict shell access from vtysh to those that intentionally turn it >> on via a ./configure option. A suid vtysh without this change could >> potentially allow an attacker to elevate his priviledges. >> >> Signed-off-by: Donald Sharp <[email protected]> >> --- >> configure.ac | 6 ++++++ >> vtysh/vtysh.c | 8 +++++++- >> 2 files changed, 13 insertions(+), 1 deletion(-) >> >> diff --git a/configure.ac b/configure.ac >> index 8a88047..b2e174d 100755 >> --- a/configure.ac >> +++ b/configure.ac >> @@ -274,6 +274,8 @@ AC_ARG_ENABLE(configfile_mask, >> AS_HELP_STRING([--enable-configfile-mask=ARG], [set mask for config >> files])) >> AC_ARG_ENABLE(logfile_mask, >> AS_HELP_STRING([--enable-logfile-mask=ARG], [set mask for log files])) >> +AC_ARG_ENABLE(shell_access, >> + AS_HELP_STRING([--enable-shell-access], [Allow user to use >> ssh/telnet/bash])) >> >> AC_ARG_ENABLE(rtadv, >> AS_HELP_STRING([--disable-rtadv], [disable IPV6 router advertisement >> feature])) >> @@ -316,6 +318,10 @@ if test x"${enable_time_check}" != x"no" ; then >> fi >> fi >> >> +if test "${enable_shell_access}" = "yes"; then >> + AC_DEFINE(HAVE_SHELL_ACCESS,,Allow user to use ssh/telnet/bash) >> +fi >> + >> if test "${enable_fpm}" = "yes"; then >> AC_DEFINE(HAVE_FPM,,Forwarding Plane Manager support) >> fi >> diff --git a/vtysh/vtysh.c b/vtysh/vtysh.c >> index 04ac550..757176a 100644 >> --- a/vtysh/vtysh.c >> +++ b/vtysh/vtysh.c >> @@ -2051,6 +2051,7 @@ DEFUN (vtysh_traceroute6, >> } >> #endif >> >> +#if defined(HAVE_SHELL_ACCESS) >> DEFUN (vtysh_telnet, >> vtysh_telnet_cmd, >> "telnet WORD", >> @@ -2110,6 +2111,7 @@ DEFUN (vtysh_start_zsh, >> execute_command ("zsh", 0, NULL, NULL); >> return CMD_SUCCESS; >> } >> +#endif >> >> static void >> vtysh_install_default (enum node_type node) >> @@ -2429,9 +2431,11 @@ vtysh_init_vty (void) >> install_element (VIEW_NODE, &vtysh_ping6_cmd); >> install_element (VIEW_NODE, &vtysh_traceroute6_cmd); >> #endif >> +#if defined(HAVE_SHELL_ACCESS) >> install_element (VIEW_NODE, &vtysh_telnet_cmd); >> install_element (VIEW_NODE, &vtysh_telnet_port_cmd); >> install_element (VIEW_NODE, &vtysh_ssh_cmd); >> +#endif >> install_element (ENABLE_NODE, &vtysh_ping_cmd); >> install_element (ENABLE_NODE, &vtysh_ping_ip_cmd); >> install_element (ENABLE_NODE, &vtysh_traceroute_cmd); >> @@ -2440,13 +2444,15 @@ vtysh_init_vty (void) >> install_element (ENABLE_NODE, &vtysh_ping6_cmd); >> install_element (ENABLE_NODE, &vtysh_traceroute6_cmd); >> #endif >> +#if defined(HAVE_SHELL_ACCESS) >> install_element (ENABLE_NODE, &vtysh_telnet_cmd); >> install_element (ENABLE_NODE, &vtysh_telnet_port_cmd); >> install_element (ENABLE_NODE, &vtysh_ssh_cmd); >> install_element (ENABLE_NODE, &vtysh_start_shell_cmd); >> install_element (ENABLE_NODE, &vtysh_start_bash_cmd); >> install_element (ENABLE_NODE, &vtysh_start_zsh_cmd); >> - >> +#endif >> + >> install_element (VIEW_NODE, &vtysh_show_memory_cmd); >> install_element (ENABLE_NODE, &vtysh_show_memory_cmd); >> >> -- >> 1.9.1 >> >> >> _______________________________________________ >> Quagga-dev mailing list >> [email protected] >> https://lists.quagga.net/mailman/listinfo/quagga-dev >> >
_______________________________________________ Quagga-dev mailing list [email protected] https://lists.quagga.net/mailman/listinfo/quagga-dev
