首页
1 comment
mdaniel大约 2 个月前
> So what does nncp-exec do? It reads stdin and encrypts it to node bob. It adds metadata, saying it’s requesting the “tarextract” command, and adding two arguments to it (the -C /var/local/backups). It writes this all into a packet file in the transmission queue for bob.<p>> When bob processes the packet, it spins up /usr/bin/tar -xpf - -C /var/local/backups, piping to it the data that had originally been piped to nncp-exec.<p>I was with them until seeing that nncp-exec accepts user provided arguments[2], and that just smells like an escape waiting to happen. Since they drew parallels between that and the command= in authorized_keys[2] I looked it up and it doesn't appear that either command= nor its ForceCommand sibling accept user provided arguments<p>I presume its target audience is where both ends of the connection are "you" (or at least fully trusted)<p>1: <a href="https://www.complete.org/nncp-concepts/#remote-execution" rel="nofollow">https://www.complete.org/nncp-concepts/#remote-execution</a><p>2: <a href="https://manpages.ubuntu.com/manpages/noble/man8/sshd.8.html#:~:text=specifies%20that%20the%20command%20is%20executed%20whenever%20this%20key%20is%20used%20for%20authentication" rel="nofollow">https://manpages.ubuntu.com/manpages/noble/man8/sshd.8.html#...</a>
评论 #43604301 未加载