mirror of
https://github.com/apache/cloudstack.git
synced 2025-10-26 08:42:29 +01:00
45e4d4fc3b
Detail: Previously the cloud user has full password-less sudo access. This commit changes that to only allow access to a specific list of commands. Been tested in production on ACS 4.0 and 4.2 mangement servers. BUG-ID: CLOUDSTACK-967 Bugfix-for: Reviewed-by: Reported-by: Signed-off-by: John Kinsella <jlk@stratosec.co> 1382560936 -0700
13 lines
446 B
Bash
13 lines
446 B
Bash
# Update the box
|
|
apt-get -y update
|
|
#below are needed for ruby perhaps
|
|
#apt-get -y install linux-headers-$(uname -r) build-essential
|
|
#apt-get -y install zlib1g-dev libssl-dev libreadline-gplv2-dev
|
|
apt-get -y install curl unzip
|
|
apt-get clean
|
|
|
|
echo 'cloud ALL=NOPASSWD:/bin/chmod, /bin/cp, /bin/mkdir, /bin/mount, /bin/umount' > /etc/sudoers.d/cloud
|
|
|
|
# Tweak sshd to prevent DNS resolution (speed up logins)
|
|
echo 'UseDNS no' >> /etc/ssh/sshd_config
|