<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi,<br>
<br>
I disagree with almost everything you wrote, but I think it boils
down to the following: <br>
<br>
On 2011-03-29 15:35, Dick Kniep wrote:
<blockquote cite="mid:vmime.4d91e024.80e.2c275bcf4bfc7309@mail.pl20"
type="cite"><span style="font-size: small;"><span
style="font-family: Arial;"><span style="font-size: small;">The
$SSH_ORIGINAL_COMMAND contains the original command that the
client wants to execute on the server. This command is
checked against the allowed commands for the user within the
wrapper.</span></span></span></blockquote>
<br>
Why must there be an extra wrapper to disallow commands, when Linux
provides enough tools to do so at system level? Why prohibit those
commands in the first place. What you are suggesting, only makes
sense when you want to limit parameters passed to a command. <br>
BTW: No one needs x2go to run "rm -rf /"! You can just do ssh
<server> rm - Why bother using x2go?<br>
<br>
Cheers<br>
Morty<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Dipl.-Ing. Moritz 'Morty' Struebe (Wissenschaftlicher Mitarbeiter)
Lehrstuhl für Informatik 4 (Verteilte Systeme und Betriebssysteme)
Friedrich-Alexander-Universität Erlangen-Nürnberg
Martensstr. 1
91058 Erlangen
Tel : +49 9131 85-25419
Fax : +49 9131 85-28732
eMail : <a class="moz-txt-link-abbreviated" href="mailto:struebe@informatik.uni-erlangen.de">struebe@informatik.uni-erlangen.de</a>
WWW : <a class="moz-txt-link-freetext" href="http://www4.informatik.uni-erlangen.de/~morty">http://www4.informatik.uni-erlangen.de/~morty</a>
</pre>
</body>
</html>