scp-restricted

Moving data files securely from one environment to another is a frequent business application requirement, so I was disappointed to learn scp doesn’t support a ‘least privilege’ approach ‘out-of-the-box’. The authors of O’Reilly’s book give an incomplete solution and note various issues, but that’s about it. Other solutions involve jailing SSH, a custom SSH shell like rssh or switching to WebDAV or ftps and using certificates. I thought these were overkill so I came up with this alternative to scp-wrapper

#!/bin/ksh
#
# scp-restricted
# 1.0  Piers C  Oct-07  Original
# Inspired by http://www.snailbook.com/faq/restricted-scp.auto.html
# Tested with OpenSSH 3.x server and Putty client
#
integer argc=0
typeset command="exec /usr/bin/scp"
typeset filename
readonly SCRIPTNAME=$(basename $0)

function fail {
  print "$SCRIPTNAME: $2" >&2
  print "$SCRIPTNAME: SSH original command should be 'scp [-v] [-t|-f] filename'" >&2
exit $1
}
if [[ "$1" == "-T" ]]; then # see test-scp-retricted
  command="print "${command}
fi

if [[ -z $SSH_ORIGINAL_COMMAND ]]; then
  fail 1 "environment variable SSH_ORIGINAL_COMMAND not set"
fi

for arg in $SSH_ORIGINAL_COMMAND; do
  argv[$argc]=$arg
  argc=argc+1
done

if (( $argc == 4 )); then
  if [[ ${argv[1]} != "-v" ]]; then
    fail 6 "arg 2 of 4 not '-v'"
  fi
  command=${command}" -v"
elif (( $argc != 3 )); then
  fail 2 "wrong number of args"
fi

if [[ ${argv[0]} != "scp" ]]; then
  fail 3 "arg[0] must be 'scp'"
fi

filename=${argv[argc-1]}
# be very conservative with filenames that we'll accept
if print ${filename} | egrep -vs '^[a-zA-Z0-9][.a-zA-Z0-9]*$'; then
  fail 5 "bad filename: $filename 
(must be alphanum, may include but not start with period)"
fi

if [[ ${argv[1]} == "-t" ||  ${argv[2]} == "-t" ]]; then
  cd $HOME/inbound || fail 7 "unable to cd ~/inbound"
  ${command} -t ${filename}
elif [[ ${argv[1]} == "-f" || ${argv[2]} == "-f" ]]; then
  cd $HOME/outbound || fail 8 "unable to cd ~/outbound"
  ${command} -f ${filename}
else
 fail 4 "args must include -t or -f"
fi
#end#
#!/bin/ksh
#
# test-scp-restricted
#
integer succeeded=0
integer failed=0

function dotest {
  export SSH_ORIGINAL_COMMAND=$1
  print "======================================"
  print 'SSH_ORIGINAL_COMMAND="'$SSH_ORIGINAL_COMMAND'"'
  print "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=="
  ./scp-restricted -T; rc=$?
  print "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=="
  if (( $rc == $2 )); then
    print 'exited ('$rc') - test **SUCCESS**'
    succeeded=$succeeded+1
  else
    print 'exited ('$rc') - test **FAILED**'
    failed=$failed+1
  fi
}
dotest "" 1
dotest "x" 2
dotest "x y z" 3
dotest "scp -p z" 4
dotest 'scp -t foo.dat' 0
dotest 'scp -t 7' 0
dotest "scp -t .." 5
dotest "scp -t a;ls" 5
dotest 'scp -t a*ls' 5
dotest 'scp -t a/ls' 5
dotest 'scp -t a�73ls' 5
dotest 'scp -f bar.dat' 0
print "Succeeded: $succeeded"
print "Failed: $failed"

Bio

I’ve been interested in computers since my mathematics teacher introduced me to Forth running on 8-bit microprocessors around 1980.

I studied physics at Oxford, which involved a lot of applied mathematics, but relatively limited access to computers. I bought an early IBM PC clone and learned C using the Whitesmiths compiler.

My first job was maintaining a forex arbitrage calculator for a banking software consultancy using Lattice C. After less than a year I moved to another financial software house and wrote a eurobond trading system in Microsoft C, first on DOS, then on the new OS/2 operating system. Having learned OS/2 GUI programming I was hired by GE to work on applications using CUA, then I was contracted by IBM to work on OS/2 2.0 in Austin, Texas. After that I consulted on OS/2 related projects for several years using VisualAge C++ and IBM Open Class until IBM announced eventual abandonment of OS/2 after release 4.0.

Wanting a break from programming I learned Oracle Database, moved to California, and switched career to database and Unix administration. Within eighteen months, however, I was at a dot-com designing a B2B marketplace, using IBM Websphere Commerce and learning Java. The project bombed and I went back to database administration and implementing Oracle Financials, then directing systems development for a retailer, where I specialize in PL/SQL

MythTV

Here are my experiences building an HTPC with MythTV.

Installation. You can start with a common Linux distro like Fedora or Ubuntu and install MythTV on top of the distro, or you can use a specialized distro like KnoppMyth. As of June ’06 I had trouble finding stable MythTV packages to install or figuring out all the dependencies needed to compile from source. I finally gave up and used KnoppMyth R5C7, which is easiest if you let it take over the machine and delete all other partitions on the boot drive, otherwise you have to know what you are doing with lilo.

Hardware. I have a couple of HDTV tuners: fortunately support for them had been added into the kernel during early ’06, but otherwise I would have been faced with applying kernel patches. Even so, it took me a while to figure out I needed the latest kernel. Decoding HDTV signals takes significant processing power: I have a 2.4GHz Celeron CPU and originally output stuttered badly. Fortunately I had an nVidia video card and selecting the XvMC option allowed the card to assist with MPEG-2 decoding and eliminate the stutter (in MythTV’s frontend menus, navigate to: Setup -> TV Settings -> Playback). To take advantage of the 16:9 aspect ratio of my Sharp Aquos display I had to manually customize my /etc/X11/XF86Config file. I’m not sure I did it right but it seems to work.

Noise. To record and play programs the HTPC has to be left switched on for extended periods of time. Even though I already had a Zalman CPU cooler the whine of the small northbridge cooler drove me to distraction: I had to special order a Zalman northbridge heatsink with an epoxy binding as the motherboard had no mounting holes for anything else. I was able to quieten my disk drive by using ‘hdparm -M128 /dev/hda’ to set its acoustic management feature.

Power. To get my HTPC to power off between recordings I had to figure out how to configure /etc/nvram-wakeup.conf for my motherboard. My motherboard (a FIC Dynasty) did not appear supported and I was unable to get it to work.

Posts navigation

1 2 3 10 11 12 13
Scroll to top