setacl not working as expected.

[Robin King_1]

We're trying to stop a certain group from telneting/sshing out from a server. This is something that is done on Solaris within the firm, but this is the first time we're attempting it on HP-UX.

They use setfacl on Solaris, I've used setacl on HP-UX.

We're removed access to /dev/tcp and /dev/udp for a group called "hcl".

Everything looks cool but doesn't have the desired affect.

$ id
uid=98512(username) gid=106(hcl) groups=20(users)
$ groups
hcl users
$ getacl /dev/tcp
# file: /dev/tcp
# owner: root
# group: root
user::rw-
group::rw-
group:hcl:---
class:rw-
other:rw-
$ telnet 10.216.34.12 2222
Trying...
Connected to 10.216.34.12.domain.com.
Escape character is '^]'.
SSH-1.99-OpenSSH_3.8p1
CLOSE
Protocol mismatch.
Connection closed by foreign host.

Here's how it works on Solaris: (group is called noaccess instead of hcl.

$ id
uid=69(username) gid=0(root)
$ groups
root noaccess
$ getfacl /dev/tcp

# file: /dev/tcp
# owner: root
# group: sys
user::rw-
group::rw- #effective:rw-
group:noaccess:--- #effective:---
mask:rw-
other:rw-
$ getfacl /dev/udp

# file: /dev/udp
# owner: root
# group: sys
user::rw-
group::rw- #effective:rw-
group:noaccess:--- #effective:---
mask:rw-
other:rw-
$ telnet 10.216.34.12
<--- NOTE THAT AT THIS POINT, username CAN'T EVEN READ /dev/udp SO NAME LOOKUP FAILS
10.216.34.12: Unknown host
$ getfacl /dev/udp

# file: /dev/udp
# owner: root
# group: sys
user::rw-
group::rw- #effective:rw-
mask:rw-
other:rw-
$ telnet staupif1 2222 <--- AT THIS POINT, /dev/udp IS READABLE BUT /dev/tcp IS NOT
Trying 10.216.34.12...
telnet: socket: Permission denied

Any ideas why we're not seeing the expected results?

[Christine Hartman]

I noticed your user is part of more than the one "hcl" group...it is also part of the group "users"...you may want to limit their group membership to just the "hcl" group.

[Christine Hartman]

oops...I missed your groups line...disregard

[Christine Hartman]

I know you can use the swacl to restrict them from ssh..I'm not sure about telnet

[Christine Hartman]

use swacl (options) Secure_Shell...see manpage for swacl for the options that are appropriate
I apologize for the broken up responses...I'm having some issues with the page refreshing and not going through.

[Robin King_1]

I've not managed to find anything in the man pages about Secure Shell options. Any chance you can point me in the direction of the doc in question on the web?

[Robin King_1]

Had a chance to look at this again. Swacl doesn't really so what I need it to do, as far as I can tell that's just limiting access to the software, not the protocols.

Still no idea why it's not working. Does the filesystem need to be explicitly set to allow ACL's? I've found another posting that mentioned trying "mount -o remount,acl /" But I can't find anything to suggest 'acl' is a valid mount switch.

[Dietmar Konermann]

Robin,

on HP-UX you could even remove these device files whithout having the desired effect. They are simply not required for calling socket(2) or bind(2). So the the approach is not really promising.

Best regards...
Dietmar.

[baiju_3]

man setacl says its only for JFS file system .Your root will be hfs , so probably it may not work on /dev directories.



thx,
bl.

[Robin King_1]

The root filesystem is xvfs:

# bdf /
Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol3 212992 138744 73808 65% /
# fstyp /dev/vg00/lvol3
vxfs

I've now tried amending the ACL for /usr/bin/telnet. This has meant I can restrict access to the executable, and it seems to work in practice. Not very pretty, but it works. Guess I can do the same with the SSH exe.