0

I'm try to set up access to a system so that a ruby web dev can remote on to a system and access a rails console in order to do some tests when they're having problems with an application. They wouldn't normally have ssh on to this machine, and we want to restrict what they can do on the machine quite heavily, the only thing they should be able to do is run the rails console and interact with the app. I thought I got on quite well initially, but now I'm stuck, because I need to also make it secure so they can't fire up a bash console, or make calls to system functions.

My approach so far was to add something similar to the following to the authorized_keys file of the new user:

command="/path/to/bash/script.sh" ssh-rsa key user@host

This forces the user who connects with the key on this line to run this one command on login and nothing else, when the script exits, they are disconnected from the session. I wrote the following script, which looks for all the app_root folders, and then puts the user in the one they have selected and fires up the rails console:

#!/usr/bin/env bash

echo "Please select the Rails folder you with to work in:"
select FOLDER in $(find /path/to/*/app_root -maxdepth 0 -type d); do
        echo "You have selected $FOLDER ($REPLY), Rails console starting...."
        cd $FOLDER
        RAILS_ENV=production bundle exec rails c
        exit 0
done

I showed this to the dev and he was really happy that he could do what he needed to. I then showed my boss, who ran:

`bash`

Which gave him a bash shell as the user I had configured for testing.

`rm -rf *`

Which allowed him to delete everything in the folder as this user was in the group and the group has write access.

This is clearly not great. So I want to restrict the user so as to not allow them to be able to run system commands.

I asked for suggestions on what I would need to stop system calls from the rails console on IRC, and the response I got was to run the process in a sandbox. But this is quite a wide ranging term, and I'm struggling to find a suitable method to use a sandbox in this context.

I have considered chroot, I could allow the user access to use the commands required to set up a chroot (with visudo), but it would take a quite a long time to set up a chroot by deploying a full isolated OS within these folders (using debootstrap in a test vm it took over 10 minutes), and seems very heavyweight for what I'm trying to do. Also, from what I have read in documentation I have found, it's still not 100% secure, you can break out if you try hard enough. Plus I would then have to set up the ruby/rails environment, and move the project in to this OS for the user to test with, and they would still be able to access system commands within the chroot.

Using seccomp was suggested, but I really don't understand how I would use it in this context (or any context for that matter).

I've looked in to the app-armour and selinux sandboxes, but neither of these are available in this ubuntu release.

Can anyone suggest a reasonably lightweight method to run a rails console in an application folder, so the dev can test their app, but which would stop them from breaking out to running bash or other system commands? I don't mind changing my approach completely as long as the end result is secure

  • You're just about ready for Docker. – Michael Hampton Dec 6 '15 at 11:03
  • Thanks, I have nothing against docker, but moving the apps into a docker environment would take a great deal of work to implement, and would need agreement from a number of different business areas as well as extensive testing. If that's the only answer, that's fine I can look in to it and make the suggestion, but is that the only way to do this? I'm surprised it's so difficult to restrict the rails console from making system calls – Rumbles Dec 6 '15 at 11:11
  • 1
    There are probably other ways, but Docker is most likely the easiest that will meet the actual security requirements. – Michael Hampton Dec 6 '15 at 11:13
  • Thanks, am I right in thinking that if the app were containered in docker and we allowed the dev a rails console on the container, they would still be able to break out to a bash shell in the same way I described earlier, but we don't care because that will only be able to affect the container, not the host system (we hope)? – Rumbles Dec 6 '15 at 11:30
  • Exactly. It doesn't matter since you'll be confined to the container anyway. – Michael Hampton Dec 6 '15 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.