Bug 1504 - Allow the user to change the environment in a secure way
Summary: Allow the user to change the environment in a secure way
Status: CLOSED WONTFIX
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: 5.1p1
Hardware: All All
: P2 enhancement
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-08-13 23:41 AEST by Vincent Lefevre
Modified: 2009-02-23 13:36 AEDT (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Vincent Lefevre 2008-08-13 23:41:08 AEST
OpenSSH should have a way to allow the user to change the environment in a secure way. Using .profile (or similar) is not a solution since such rc files are not always sourced when a command is used, such as in

  ssh -t <host> env

with the official bash (not Debian's) on the remote side.

The ~/.ssh/environment solution cannot be used in practice since:

1. Values are hardcoded in the file (I have not tried, though, but things like `program` are not documented, so I suppose that this isn't possible).

2. PermitUserEnvironment is set to "no" by default, and would remain to "no" anyway if there are access restrictions (I wonder if this is really useful though, because ~/.ssh/rc probably allows the user to do much more).

So, I think that sshd should have an option to allow the user to set the chosen remote shell independently of his login shell (which could also be a wrapper to the login shell, that sets up the environment). This is more or less a shorthand of: ssh ... "exec my_shell -lc ..."

Alternatively, make the ~/.ssh/environment mechanism more flexible (not just "yes" or "no", and in some conditions, allow the user to run programs such as LC_CTYPE=`command` -- but as the user can run programs in his ~/.ssh/rc file, I don't think this is a problem here).
Comment 1 Damien Miller 2008-11-03 20:10:21 AEDT
Sorry, but we aren't interested in adding more mechanisms for env setting or making the existing ones more powerful (certainly not adding shell execution to .ssh/environment).

sshd_config:AcceptEnv and ssh_config:SendEnv should do almost everything you need already.
Comment 2 Vincent Lefevre 2008-11-03 20:48:03 AEDT
FYI, sshd_config:AcceptEnv and ssh_config:SendEnv are useless for things like locale settings, since the values are platform-specific.

So, the only solution is to write a wrapper to ssh, but with the need to parse the arguments, which is not really easy...
Comment 3 Damien Miller 2009-02-23 13:36:03 AEDT
Close bugs fixed/reviewed for openssh-5.2 release