lucaspalomodevelop/core
1
0
Fork 0
mirror of https://github.com/lucaspalomodevelop/core.git synced 2026-03-14 08:34:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

openssh: do not allow sftp login for non-admins

Browse Source 
Also suggested by @fabianfrz.  Not perfect yet as we seem
to mix wheel with access and either need to lock down shell
access along with it or somehow tag along the shell privilege.

Small race in the group setting on the user page.

PR: https://forum.opnsense.org/index.php?topic=6994.0
This commit is contained in:
Franco Fichtner 2018-01-27 13:38:35 +00:00
parent 1fbbecec2e
commit 2fc86a72bf
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/etc/inc/plugins.inc.d/openssh.inc
View File

@ -157,7 +157,8 @@ function openssh_configure_do($verbose = false, $interface = '')
$sshconf .= "UseDNS no\n";
$sshconf .= "X11Forwarding no\n";
$sshconf .= "PubkeyAuthentication yes\n";
$sshconf .= "Subsystem\tsftp\tinternal-sftp\n";
$sshconf .= "Subsystem sftp internal-sftp\n";
$sshconf .= "AllowGroups wheel\n";
if (isset($sshcfg['permitrootlogin'])) {
$sshconf .= "PermitRootLogin yes\n";
} else {

2
src/www/system_usermanager.php
View File

@ -361,8 +361,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
$a_user[] = $userent;
}
local_user_set($userent);
local_user_set_groups($userent, $pconfig['groups']);
local_user_set($userent);
write_config();
if (!empty($pconfig['chkNewCert'])) {