apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-10-26 08:42:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

Summary: Updated sudoers approved commands for cloud user

Browse Source 
Detail: Previously the cloud user has full password-less sudo access.
This commit changes that to only allow access to a specific list of
commands. Been tested in production on ACS 4.0 and 4.2 mangement servers.

BUG-ID: CLOUDSTACK-967
Bugfix-for:
Reviewed-by:
Reported-by:
Signed-off-by: John Kinsella <jlk@stratosec.co> 1382560936 -0700
This commit is contained in:
John Kinsella 2013-10-23 13:42:16 -07:00
parent 5133812c85
commit 45e4d4fc3b
8 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
python/lib/cloudutils/serviceConfig.py
View File

@ -727,7 +727,7 @@ class sudoersConfig(serviceCfgBase):
def config(self):
try:
cfo = configFileOps("/etc/sudoers", self)
cfo.addEntry("cloud ALL ", "NOPASSWD : ALL")
cfo.addEntry("cloud ALL ", "NOPASSWD : /bin/chmod, /bin/cp, /bin/mkdir, /bin/mount, /bin/umount")
cfo.rmEntry("Defaults", "requiretty", " ")
cfo.save()
return True

2
server/conf/cloudstack-sudoers.in
View File

@ -18,5 +18,5 @@
# The CloudStack management server needs sudo permissions
# without a password.
@MSUSER@ ALL =NOPASSWD : ALL
@MSUSER@ ALL =NOPASSWD : /bin/chmod, /bin/cp, /bin/mkdir, /bin/mount, /bin/umount

2
tools/appliance/definitions/devcloud/base.sh
View File

@ -6,7 +6,7 @@ apt-get -y update
apt-get -y install curl unzip
apt-get clean
echo 'cloud ALL=NOPASSWD:ALL' > /etc/sudoers.d/cloud
echo 'cloud ALL=NOPASSWD:/bin/chmod, /bin/cp, /bin/mkdir, /bin/mount, /bin/umount' > /etc/sudoers.d/cloud
# Tweak sshd to prevent DNS resolution (speed up logins)
echo 'UseDNS no' >> /etc/ssh/sshd_config

2
tools/appliance/definitions/systemvm64template/base.sh
View File

@ -5,7 +5,7 @@ apt-get -y update
apt-get -y install curl unzip
# Set up sudo
echo 'vagrant ALL=NOPASSWD:ALL' > /etc/sudoers.d/vagrant
echo 'vagrant ALL=NOPASSWD:/bin/chmod, /bin/cp, /bin/mkdir, /bin/mount, /bin/umount' > /etc/sudoers.d/vagrant
# Tweak sshd to prevent DNS resolution (speed up logins)
echo 'UseDNS no' >> /etc/ssh/sshd_config

2
tools/appliance/definitions/systemvm64template/postinstall.sh
View File

@ -105,7 +105,7 @@ setup_accounts() {
echo "root:$ROOTPW" | chpasswd
echo "cloud:`openssl rand -base64 32`" | chpasswd
sed -i -e '/Defaults\s\+env_reset/a Defaults\texempt_group=admin' /etc/sudoers
sed -i -e 's/%admin ALL=(ALL) ALL/%admin ALL=NOPASSWD:ALL/g' /etc/sudoers
sed -i -e 's/%admin ALL=(ALL) ALL/%admin ALL=NOPASSWD:/bin/chmod, /bin/cp, /bin/mkdir, /bin/mount, /bin/umount/g' /etc/sudoers
# Disable password based authentication via ssh, this will take effect on next reboot
sed -i -e 's/^.*PasswordAuthentication .*$/PasswordAuthentication no/g' /etc/ssh/sshd_config
# Secure ~/.ssh

2
tools/appliance/definitions/systemvmtemplate/base.sh
View File

@ -7,7 +7,7 @@ apt-get -y install curl unzip
apt-get clean
# Set up sudo, TODO: Check security concerns
echo 'cloud ALL=NOPASSWD:ALL' > /etc/sudoers.d/cloud
echo 'cloud ALL=NOPASSWD:/bin/chmod, /bin/cp, /bin/mkdir, /bin/mount, /bin/umount' > /etc/sudoers.d/cloud
# Tweak sshd to prevent DNS resolution (speed up logins)
echo 'UseDNS no' >> /etc/ssh/sshd_config

2
tools/appliance/definitions/systemvmtemplate/postinstall.sh
View File

@ -104,7 +104,7 @@ setup_accounts() {
echo "root:$ROOTPW" | chpasswd
echo "cloud:`openssl rand -base64 32`" | chpasswd
sed -i -e '/Defaults\s\+env_reset/a Defaults\texempt_group=admin' /etc/sudoers
sed -i -e 's/%admin ALL=(ALL) ALL/%admin ALL=NOPASSWD:ALL/g' /etc/sudoers
sed -i -e 's/%admin ALL=(ALL) ALL/%admin ALL=NOPASSWD:/bin/chmod, /bin/cp, /bin/mkdir, /bin/mount, /bin/umount/g' /etc/sudoers
# Disable password based authentication via ssh, this will take effect on next reboot
sed -i -e 's/^.*PasswordAuthentication .*$/PasswordAuthentication no/g' /etc/ssh/sshd_config
# Secure ~/.ssh

2
tools/devcloud/src/deps/boxes/basebox-build/postinstall.sh
View File

@ -28,7 +28,7 @@ groupadd -r admin
usermod -a -G admin devcloud
echo "root:password" | chpasswd
sed -i -e '/Defaults\s\+env_reset/a Defaults\texempt_group=admin' /etc/sudoers
sed -i -e 's/%admin ALL=(ALL) ALL/%admin ALL=NOPASSWD:ALL/g' /etc/sudoers
sed -i -e 's/%admin ALL=(ALL) ALL/%admin ALL=NOPASSWD:/bin/chmod, /bin/cp, /bin/mkdir, /bin/mount, /bin/umount/g' /etc/sudoers
mkdir /home/devcloud/.ssh
chmod 700 /home/devcloud/.ssh