fuadmin(1)

NAME

fuadmin

SYNTAX
fuadmin -c
    Generate a database of MD5 hashes and a user template.
fuadmin -u
    Copy the template configuration file for each user on the system.

DESCRIPTION

fuadmin is a configuration program to aid administrators is configuring fush(1). fuadmin creates an MD5 hash database of each file in your PATH. This database is stored in _PREFIX_/etc/fush/fush.db. fuadmin also creates a template user security configuration file which contains all commands in the fush.db and the default configuration options.

fuadmin makes a 'best guess' about commands before adding them to the template ACL. If a command name matches one of the following regular expressions, it is not added.

".*sh.?[\.0-9]*$" ".*perl.*" ".*tcl.*" ".*python.*" ".*emacs.*"

In addition to these regular expressions, the following list of other commands that are not added.

xargs expect awk find nohup time nice

CONFIGURING
fuadmin -c

The -c option tells fuadmin to generate a new database and template file. fuadmin will go through your PATH and create MD5 sums for each command.

When you start fuadmin, it will prompt you for where you would like to store your database and template. If you installed fush in the default directory, simple press enter to accept the default: '/usr/local/etc/fush'.

After telling fuadmin where the config files are stored, it will begin to search though your path and create Md5 sums for each file in your path. Before searching a path element, fuadmin will ask you if you would like the path to be included in the list of commands. You can respond with yes or no (y or n), the answer is not case sensetive.

A typical setup will include adding the /bin, /usr/bin and /usr/local/bin directories. I do not typically include the /sbin, /usr/sbin, /usr/local/sbin or /usr/X11R6/bin paths because most restricted users do not require these comamnds.

After running fuadmin you will have two new files /usr/local/etc/fush/fush.db, (the MD5 database) and /usr/local/etc/fush/fush.security (the user configuration template). You can now copy the fush.security file to username.security in the /usr/local/etc/fush directory to setup a new user on the system. After copying the file you should edit it to your specific needs. You should also review the whitelist of commands and make sure that none of them will alow the user to exec an external command, or run a command that could compromise the security of your system.

fush will not allow a user to login if the username.security file is not created.

fuadmin -u

The -u option creates a security file for every user on the system. fuadmin iterates over the users on the system by calling getpwent() and copies the fush.security file for each user. This process will create a seperate configuration for every user on the system.

SECURITY OPTIONS
These options are allowed in the security configuration file of each user. Options are set as key vlaue pairs. In the case of toggle options (on or off), not setting a value leaves it off, or unset. Setting a toggle option to any value other than 'no' turns it on. Conventionaly values are turned on by setting them to 'yes'. Some options take paramaters. Options that take paramaters are set exactly like any other option (key value pair), but different values have different effects on the option. These options are not set to yes. Any option can be unset or turned off by setting it to 'no'.

Examples:

# Pound signs are comments # This key is set to a value of 200 some_value=200

# This option is turned on some_option=yes

# This option is turned off some_option=no

fu_exec_full_path
Normaly the shell searches the users PATH for a command. The first matching command in the path is executed. If no matching command is found, then an error occurs. This option allows a user to execute commands by their full path names and execute command outside of their path. Not setting this value prevents users from executing a command as a full path. If this value is set to yes, users may not execute commands by specifiying their full path.

fu_allow_interactive
Setting this value to yes causes the shell to work as expected. Setting this value to no causes the shell to deny access to shells that are connected to a valid terminal device (see ttyname(3)). If this value is set to no, only commands that appear as arguments to fush via the -c option are executed.

fu_chdir
Setting this value to 'no' prevents users from changing thier working directory. This will keep them locked into their home directory. Future versions of this feature will forcefully set the directory to the user's home directory, and prevent the user from changing the home environment variable

fu_max_args
This value sets the maximum number of arguments that fush will allow on the command line. If the number of arguments exceeds this number, the command is not executed and an error is printed to stderr. This behavior effects all commands executed from command line, or read from a login script. This is useful to prevent users from passing an excessivly large number of arguments to a potentialy dangerous or vulnerable command.

fu_background_nice
This option forces a nice value on background commands. Setting this to a high value will cause commands in the packground to receive a lower scheduling priority.Tested on BSD only

fu_max_background
This option sets the maximum number of concurent background processes that may be run by a user. If a user attempts to run a background command after the maximum numeber of background commands has been reached, the command is not executed and an error message is printed to stderr.

fu_limit_exec
fush has the ability to restrict what commands may be executed by a user from the shell. By setting this option to 'include', only commands listed in the security configuration file may be executed by the user. You can set this option to blacklist by setting the value to 'exclude'. The exclude option prevents commands listed in the security configuration from being executed. Setting this value to any value other than 'include' or 'exclude' disables command restrictions, typically this would be the 'no' value.

fu_home_rc
fush can parse login and resource scripts for other shells. This has limited functionality, for instance syntax supported by other shells may not be supported by fush. Each line in the resource script is executed as a seperate fush command, just as if it were executed on the command line. The value for this option should be the resource script name in the users home directory. Don't worry about adding the home directory name, it is prepended for you for eachm user. To process the user's ~/.profile set this value to .profile.

fu_system_rc
This value is set to a system wide resource script such as /etc/profile. Each command is executed by the shell as if it appeared on the command line. Note, this is not the option to enable or disable the systemwide _PREFIX_/etc/fush/fushrc file.

fu_use_systemrc
This option specifies wether the shell should read _PREFIX_/etc/fush/fushrc system wide fush resource script. A value of 'yes' reads the script, a value of 'no' does not read the script.

fu_use_homerc
This option specifies whether the shell should read ~/.fushrc system resource script. A value of 'yes' reads the script, a value of 'no' does not read the script.

fu_logical_and
This option controls wether a user can use the logical and operator &&. Setting this value to 'yes' allows users to use this construct. A value of 'no' disables this ability.

fu_logical_or
This option controls wether a user can use the logical or operator ||. Setting this value to 'yes' allows users to use this construct. A value of 'no' disables this ability.

fu_multi_command
This option controls wether a user can run multiple programs (commands) in a single command. Setting this value to 'yes' allows users to use this construct and gives them the ability to use the ; and | constructs. A value of 'no' disables this ability to use the ; and | constructs.

fu_redirect_in
This option controls wether a user can use the input redirection operator <. Setting this value to 'yes' allows users to reditect stdin to a file. A value of 'no' disables this ability.

fu_redirtect_out
This option controls wether a user can use the output redirection operators > and >>. Setting this value to 'yes' allows users to reditect output to a file. A value of 'no' disables this ability.

fu_redirect_pipe
This option controls wether a user can use the | output redirection operator | to redirect the output of one command to the input of the next command. Setting this option to yes allows pipe redirection. A value of 'no' disables this feature.

COMMAND REDIRECTION
Command redirection is a powerful feature of fu shell. It allows an administrator to restrict unsafe commands while providing safe substitutions. Command redirection happeds just before command execution. The command entered by the user is compared against an internal list of redirection commnads. If a match is found the origional command is replaced. A common use of command redirection is to redirect system shells back to fush and to redirect command interpreters such as vi to their restricted equivelents (rvim).

There are two types of command redirection. Command name redirection and fullpath redirection. When a command is to be executed, the PATH is searched for the location of the command. If the command begins with a '.' or '/' then the path is resolved automatically as a local path or full path respectivly, otherwise the environment variable PATH is searched for the command. Once the full path is known it is compared against the full path redirection list. If a match is found, the path is replaced and the command is executed. If there is no match, then the path is striped up to the final '/' to find the command name. This name is compared against a list of command names. If a match is found then the first command matched the replaced name is the path is substituted for the origional command and executed.

Example:

subst_command vi=rvim subst_path /bin/sh=/usr/local/bin/fush

Where:

/bin/sh /usr/local/bin/fush /usr/bin/vi /bin/vi /tmp/vi /usr/local/bin/rvim

an attempt to execute /bin/sh would execute /usr/local/bin/fush. Likewise, any attempt to execute /usr/bin/vi, /bin/vi or /tmp/vi would result in the execution of /usr/local/bin/fush.

ENFORCED ENVIRONMENT
fush allows you to enforce the user's environment. This allows the administrator to lock down environment variables like PAGER, SHELL, LD_LIBRARY_PATH and others. The default configuration includes hard set library search paths to void, as well as locking the user's shell to /usr/local/bin/fush.

Setting a hard envrionment variable is simple. Simply add a keyword 'set_env' followed by a key value pair for the value. Example:

set_env SHELL=/usr/local/bin/fush

You may also set the value to null (new line) to enforce no value for this environment variable.

RESTRICTED OWNERS
fush allows the administrator to limit what commands may be executed to a white list of file owners. This feature also allows the administrator to restrict commands based on the file ownership. These features can be turned off by setting the configuration option fu_restrict_owner to 'no'.

To restrict available commands to the list of file owners root and bin, use the keyword allow_owners followed by = and the list of users seperated by space followed by a newline. The allow_groups option uses the same syntax, example:

fu_restrict_owner=yes allow_owners=root bin allow_groups=root wheel bin

SYSLOG
see fush(1) for more informaion on fush syslog. This feature can be turned off by setting the security configuration option fu_syslog to 'no'. This option must be set to 'yes' to enable syslog support (default).

FU_LOG_FACILITY
setting the syslog facility to write syslog data to a different file is simple (sort of). Just set the fu_log_facility value to the syslog facility of your choise in decimal. This can be somewhat complicated figuraing out the correct base 10 value since the predefined constants LOG_LOCAL, LOG_FTP, etc are not available. One simple solution is to #include <syslog.h> and then printf("%d", LOG_LOCAL5) or whatever your logging facility is. If this gets to be too complex, just leave the facility at the default 128 (LOG_LOCAL0 on my FreeBSD system).

CONSOLE LOGGING
Console logging is a new feature. Console logging allows an administrator to keep a log of everything displayed on the user's terminal. When this setting is enabled the fush process forks and if it is installed suid it will switch to the effective user id in the parrent process and switch to the real user id in the child process. The parrent process then opens a new pty controling terminal and closes any previously opened terminals. It then handles all input and output and writes data to the child process terminal AND the log file. The child process begins functioning as a normal user shell reading commands from stdin. To enable console logging, add the line: fu_log_output=<filename> to the user's configuration file.

Console logging only effects interactive sessions. This prevents processes like sftp-server from dumping tons of binary data to the log. If this is the functionality you want, it is left as an exercise to the reader.

RESTRICTING SSH ACCESS
Fush can be used to restrict ssh terminal access to only sftp or scp access. There are several other shell "wrappers" available for ssh that do this same process. Fush is slightly different in that it can also be used as a normal shell, provide enhanced logging and more control in general over this process. Fush also allows the administrator to quickly reconfigure how it works.

To restrict interactive access to the system begin by setting the fu_allow_interactive to 'no'. This will prevent interactive commands from being executed. After denying interactive access, set the binary execution restriction to whitelist. This can be done by setting fu_limit_exec to 'include'. This will only allow the system to execute commands listed in the file. Since commands exedcuted as arguments to fush are executed before processing resource scripts, users can not upload fush.rc files to execute commands upon sftp login.

Now you need to find your sftp-server application. On my system it is located in /usr/local/libexec/sftp-server. If ssh is installed in /usr/local, your configuration will look like:

####### sample sftp only configuration ####### fu_allow_interactive=no fu_limit_exec=include

/usr/local/libexec/sftp-server /usr/local/bin/scp /bin/ls ##############################################