fush(1)

NAME

FU shell

SYNTAX

fush
fush [-c string]
fuadmin [-c]

DESCRIPTION

fush is a Unix shell replacment. It provides improved logging support for the shell to keep an eye on users. It also provides many extra security features. With fush you can restrict and log everything. You can restrict shell operators ( && || > < ; | & ) and or log their usage. You can enable or disable shell features for users such as putenv or alias. Fush also has the ability to limit which commands can be executed from the command line. A list of MD5 sums is kept on all system binaries. When a user trys to execute a command, an MD5 hash is generated wich is compared against the user's ACL. If the MD5 sum and full path match an approved command in the ACL, the command is executed.

Fush is not a full featured shell with sh(1) or csh(1) style programming commands. Fush is used to restrict what commands a user can exec from the shell and log all executed commands while supporting the most common and useful shell featrues. Because of the overhead involved wil supporting the ACL, fush requires up to 3X as much memory as other shells (5MB) and is slower on startup that other shells. Efforts have been made to reduce the memory requirements. For typical installs, the loaded shell with ACL is about 2-3MB.

fush supports:
  * pipes
  * input redirection
  * ouput redirection
  * logical OR
  * logical AND
  * background commands
  * multiple commands on the command line
  * setting and unsetting environment variables
  * umask
  * aliases
  * quoting
  * command aliases
  * fushrc resource scripts
  * .profile resource scripts
  * syslog logging
  * full session logging through bulitin script interface
  * restricting commands a user can exec
  * readline history support
  * plus more!

fush does not support:
  * Full IEEE Std 1003.2 (``POSIX.2'') specification for the shell
  * fush DOES make an effort to emulate sh(1)

Fush has many configuration options. Fush stores it's config files in _PREFIX_/etc/fush. Configuration files consist of #CONF_DIR#/fush.db which is the MD5 database of user commands. #CONF_DIR#/fush.security is a generic configuration file generated by fuadmin. It is a list of basic commands that can be executed, excluding a list of commands that fuadmin determined will break the security of fush (see SECURITY in this document). The #CONF_DIR#/username.security file configures security options for the user, username. The username.security file should be owned by root and the users group with 0640 permissions.

SECURITY CONFIGURATION
Fush has an administration program fuadmin(1) to help administrators setup the access controls that fush provides. fuadmin will create a database of MD5 hashes in #CONF_DIR#/fush.db. This database will be read when the shell loads. Along with this configuration file, the file #CONF_DIR#/username.security will be loaded. The .security file contains the configuration for the currently logged on user.

See fuadmin(1) for a list of security configuration options.

USER CONFIGURATION
Startup and shutdown
       A login shell begins by reading the security configuration files (see SECURITY CONFIGURATION) After parsing these files, fush reads commands from the system files /usr/local/etc/fush/fushrc and /etc/profile if these are enabled in the security configuration. It then executes commands from files in the user's home directory: ~/.fushrc and ~/.profile if enabled by the security configuration.

       Non-login shells read the security configuration and startup scripts executing commands found in them. If the -c option is passwd as the first argument to fush then the startup files are not read except for the security files. Everything after the -c option is treated as a command and parsed by the shell before exiting.

    For interactive logins, the shell begins reading commands from the terminal, prompting with `hostname> '. (Processing of arguments and the use of the shell to process files containing command scripts are described later.) The shell repeatedly reads a line of command input, breaks it into words, places it on the command history list, parses it and executes each command in the line.

prompt Fush supports csh style prompts. Fush will prompt the user with the environment variable 'prompt'. The prompt environemnt variable supports some special characters that are interpreted by the shell and expanded to the given information:

%/ The current working directory.

%~ The current directory with home directories expanded to ~

%M The full hostname.

%m The hostname up to the first `.'.

%n The name of the currently logged in user.

%% A '%' sign.

%# A > for normal users, a # for root.

%? The return code for the last executed command.

%L A newline character.

%s Secconds.

%i Minutes.

%h Hour (24 hour format).

%w Day of month.

%D The day of the week.

%Y The current year.

LEXICAL STRUCTURE
* FIX ME *

readline(3) tokenize
  * expand process

Control Operators:
    & &&
    | || ;

Redirection operators:
    < > >>

QUOTING
* FIX ME *

Quoting is used to remove the special meaning of certain characters or words to the shell, such as operators, whitespace, or keywords. There are three types of quoting: matched single quotes, matched double quotes, and backslash.

Single Quotes
 Enclosing characters in single quotes preserves the literal meaning of all the characters (except single quotes, making it impossible to put single-quotes in a single-quoted string).

Double Quotes
 NOT IMPLEMENTED AS SUCH: same as single quotes

Backslash
 A backslash preserves the literal meaning of the following character, with the exception of the newline character (. A backslash preceding a newline is treated as a line continuation.

ALIASES
An alias is a name and corresponding value set using the alias built-in command. Whenever a reserved word may occur (see above), and after checking for reserved words, the shell checks the word to see if it matches an alias. If it does, it replaces it in the input stream with its value. For example, if there is an alias called ``lf'' with the value ``ls -F'', then the input

           lf foobar

     would become

           ls -F foobar

Aliases provide a convenient way for naive users to create shorthands for commands without having to learn how to create functions with arguments. They can also be used to create lexically obscure code. This use is discouraged.

LOGGING
Fush logs to syslog. This allows the application to write to the log file, but not read it, or alter it. By default, fush logs to local0. This can be changed by setting the fu_log_facility value. This value maps directly to the defined values in /usr/include/syslog.h, it must be defined in decimal (base 10). Read syslog(3) and syslogd(8) for more information

To enable logging in Fush, you need to edit your syslog.conf file and add the following line (replace local0 with your logging facility):

local0.*    /var/log/fush.log

Then restart your syslog daemon. This will direct all fush users to log all entered commands to /var/log/fush.log. Fush prepends each log entry with the username, so tracking users is simple.

COMMAND-LINE EDITOR
see readline(3)

SECURITY

Basic fush security requires that any command that the user executes not allow the user to transfer comtrol to another system command. This usualy includes installed shells (/bin/sh, /bin/csh, etc). To make the most of the access controls provided with fush, you should create a shell group and set the group owner for each shell on your system to this group. Then change the permissions on these shells to 0755. fush users should not be included in this group. This way, if a user can execute an external command from one of the approved commands, he/she will not be able to execute another shell.

For additional security, users should always be restricted to a set of approved commands. This prevents users from downloading commands from external systems and executing them. You can enable this type of restriction by setting the user configuration value:

fu_limit_exec = INCLUDE

commands that can exec other commands such as those listed here, should never be included in a list of approved commands.
  * vi
  * emacs
  * find
  * xargs
  * tclsh
  * expect
  * awk
  * perl
  * python
  * nohup
  * others

FILES

/usr/local/bin/fush
/var/log/fush.log
/usr/local/etc/fush/fush.db
/usr/local/etc/fush/username.security

AUTHORS

Cory Marsh<cmarsh@idahopower.com>

SEE ALSO

fuadmin(1) sh(1) csh(1) osh(1) readline(3)