The SSH Relay feature is enhanced to support allow commands. With this enhancement, on a privileged SSH session, the end user is allowed to run only the allowed commands and for all the other commands, the user would be denied command execution with a 'Permission Denied' message. This implementation is applicable from Privileged Account Manager 3.7 onwards.
The SSH Relay policy configuration remains as it is today. For the alllow commands support, the same or similar policy can be enhanced by attaching a command control script to the Policy or Rule and by defining the allowed commands as Script Arguments to the Policy or Rule. Only one instance of the script must be created manually and the same can be attached to the Rule where the allow commands are to be applied. The particular Rule’s Script Arguments determines the commands that are allowed for the session authorized by that Rule.
When the user connects to Privileged Account Manager and establishes a privileged SSH session, if the authorizing Rule/Policy is associated with an allowed script and arguments, the user is presented with a list of allowed commands.
If the SSH Relay Rule is not associated with the particular script and it’s arguments then the policy behavior would be like a normal ssh-relay policy where the user would be given the privileged ssh session with no command restriction/control by SSH Relay server. The target server can be an SSH server or Telnet server.
NOTE:With this feature, the user is restricted or allowed to run only the commands that are allowed and the runUser (user on target) would be as per the Policy or Rule configuration. The target OS may also restrict the allowed command based on the runUser set on the Rule or Policy. For example, if /sbin/fdisk is a allowed command as per SSH Relay Policy or Rule and the runUser set on the Rule or Policy is a normal non-root user, then the user would still be denied access by the target Operating System permission as the command can be executed by a root-user only.
You can set up these permissions using the following procedure:
Click Administration Console > Command Control, create an SSH-Relay policy. You could also use the SSH Relay template to create this policy.
Create a new Command Control Script, name it as allow command. The contents of the script should be as below:
my $cmds = $args->arg("Commands");
if ($cmds) {
$cmds =~ s/\r/\n/g;
$meta->child("Command")->arg("CmdList",$cmds);
}
return 1;Associate the script with the SSH policy by dragging the script and dropping it on to the SSH-Relay Rule.
The Commands are taken from ScriptArgs set on the SSH-Relay Rule. The name of the ScriptArgs should be Commands and the list of commands are delimited by new-line as shown in the below example. The command can also be a regex.
ssh -t -p 2222 john@rhel8din
Warning: Permanently added '[rhel8din]:2222' (RSA) to the list of known hosts.
john@rhel8din's password:
0) Exit
1) ssh relay - root@ssh
Enter option (1-1): 1
Allowed commands in this session are :
1) id 2) /sbin/ifconfig*
Password:
Last failed login: Thu Dec 10 10:21:51 MST 2020 from 10.71.130.191 on ssh:notty
There were 3 failed login attempts since the last successful login.
Last login: Mon Nov 30 12:16:24 2020 from 164.99.210.133
vlab031509:~ # id
uid=0(root) gid=0(root) groups=0(root)
vlab031509:~ # /etc/passw
Permission denied!d
vlab031509:~ # /sbin/ifconfig
eth0 Link encap:Ethernet HWaddr 00:50:56:86:F2:A2
inet addr:10.204.101.237 Bcast:10.204.103.255 Mask:255.255.252.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:511746838 errors:0 dropped:245080 overruns:0 frame:0
TX packets:18860334 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:55836832085 (53250.1 Mb) TX bytes:12912375114 (12314.2 Mb)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:17818674 errors:0 dropped:0 overruns:0 frame:0
TX packets:17818674 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:8788789816 (8381.6 Mb) TX bytes:8788789816 (8381.6 Mb)