topic Re: setacl not working as expected. in Operating System - HP-UX

setacl not working as expected.

Robin King_1 — Mon, 12 Dec 2005 10:41:01 GMT

We're trying to stop a certain group from telneting/sshing out from a server. This is something that is done on Solaris within the firm, but this is the first time we're attempting it on HP-UX.

They use setfacl on Solaris, I've used setacl on HP-UX.

We're removed access to /dev/tcp and /dev/udp for a group called "hcl".

Everything looks cool but doesn't have the desired affect.

$ id
uid=98512(username) gid=106(hcl) groups=20(users)
$ groups
hcl users
$ getacl /dev/tcp
# file: /dev/tcp
# owner: root
# group: root
user::rw-
group::rw-
group:hcl:---
class:rw-
other:rw-
$ telnet 10.216.34.12 2222
Trying...
Connected to 10.216.34.12.domain.com.
Escape character is '^]'.
SSH-1.99-OpenSSH_3.8p1
CLOSE
Protocol mismatch.
Connection closed by foreign host.

Here's how it works on Solaris: (group is called noaccess instead of hcl.

$ id
uid=69(username) gid=0(root)
$ groups
root noaccess
$ getfacl /dev/tcp

# file: /dev/tcp
# owner: root
# group: sys
user::rw-
group::rw- #effective:rw-
group:noaccess:--- #effective:---
mask:rw-
other:rw-
$ getfacl /dev/udp

# file: /dev/udp
# owner: root
# group: sys
user::rw-
group::rw- #effective:rw-
group:noaccess:--- #effective:---
mask:rw-
other:rw-
$ telnet 10.216.34.12
<--- NOTE THAT AT THIS POINT, username CAN'T EVEN READ /dev/udp SO NAME LOOKUP FAILS
10.216.34.12: Unknown host
$ getfacl /dev/udp

# file: /dev/udp
# owner: root
# group: sys
user::rw-
group::rw- #effective:rw-
mask:rw-
other:rw-
$ telnet staupif1 2222 <--- AT THIS POINT, /dev/udp IS READABLE BUT /dev/tcp IS NOT
Trying 10.216.34.12...
telnet: socket: Permission denied

Any ideas why we're not seeing the expected results?

Re: setacl not working as expected.

Christine Hartman — Mon, 12 Dec 2005 15:53:51 GMT

I noticed your user is part of more than the one "hcl" group...it is also part of the group "users"...you may want to limit their group membership to just the "hcl" group.

Re: setacl not working as expected.

Christine Hartman — Mon, 12 Dec 2005 15:55:54 GMT

oops...I missed your groups line...disregard

Re: setacl not working as expected.

Christine Hartman — Mon, 12 Dec 2005 15:59:47 GMT

I know you can use the swacl to restrict them from ssh..I'm not sure about telnet

Re: setacl not working as expected.

Christine Hartman — Mon, 12 Dec 2005 16:02:25 GMT

use swacl (options) Secure_Shell...see manpage for swacl for the options that are appropriate
I apologize for the broken up responses...I'm having some issues with the page refreshing and not going through.

Re: setacl not working as expected.

Robin King_1 — Tue, 20 Dec 2005 10:10:45 GMT

I've not managed to find anything in the man pages about Secure Shell options. Any chance you can point me in the direction of the doc in question on the web?

Re: setacl not working as expected.

Robin King_1 — Thu, 05 Jan 2006 06:01:49 GMT

Had a chance to look at this again. Swacl doesn't really so what I need it to do, as far as I can tell that's just limiting access to the software, not the protocols.

Still no idea why it's not working. Does the filesystem need to be explicitly set to allow ACL's? I've found another posting that mentioned trying "mount -o remount,acl /" But I can't find anything to suggest 'acl' is a valid mount switch.

Re: setacl not working as expected.

Dietmar Konermann — Thu, 05 Jan 2006 06:51:22 GMT

Robin,

on HP-UX you could even remove these device files whithout having the desired effect. They are simply not required for calling socket(2) or bind(2). So the the approach is not really promising.

Best regards...
Dietmar.

Re: setacl not working as expected.

baiju_3 — Thu, 05 Jan 2006 09:17:41 GMT

man setacl says its only for JFS file system .Your root will be hfs , so probably it may not work on /dev directories.

thx,
bl.

Re: setacl not working as expected.

Robin King_1 — Thu, 05 Jan 2006 10:46:44 GMT

The root filesystem is xvfs:

# bdf /
Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol3 212992 138744 73808 65% /
# fstyp /dev/vg00/lvol3
vxfs

I've now tried amending the ACL for /usr/bin/telnet. This has meant I can restrict access to the executable, and it seems to work in practice. Not very pretty, but it works. Guess I can do the same with the SSH exe.