yownas / vsh Goto Github PK

If there is white space after the user name in vshd.ini in the [hosts] section, access to the host is denied.

Rename vcp to vshtar and patch vsh to enable: scp -S vsh

User should not be prompted for a password while creating the X11-key

Use awk to check/clean command sent by the vsh-client, to make it harder for an attacker to execute unauthorized code

Example:
echo "" | awk '{d=ENVIRON["SSH_ORIGINAL_COMMAND"];if (match(d, "[^a-zA-Z0-9\\-_ .;:]")) print "usage"; else print d}'

When getting ct-list from hosts vsh saves the hostname reported by the vz-host instead of the name used to connect to it.

This can make things break if you have to connect to the hosts through another ip/name than the hostname set on the host.

(Should be simple to fix in the list-function, just replace the reported hostname with the one use to connect.)

vsh_updatestate should remove all old tmp-files before searching for clients. Otherwise old client-lists will be used for hosts that are removed from ~/.vsh/hosts

Solution: Add "stdbuf -i0 -o0 -e0 " where it is needed

The last step of vsh is to clean up temporary keys and/or ssh-agents.

If there is an error or the script use exit in any way this step is skipped.

Solution: Add a "trap vsh_cleanup EXIT" to fix this.

Using -h when trying to connect to a proxied container should give an error with more information.

Tab/space separated is dumb, some functions like vsh_gethost() and vsh_getctname() might return faulty results if it happen to match other field.

vcp "file with spaces.txt" remotehost:
file: No such file or directory
with: No such file or directory
spaces.txt: No such file or directory

Log...
...container-name/hostname not just id.
...at exit

Add something like:

container:-group

..to deny the group access to the container.

Enable vsh to use a vshd-host without root access for proxy-clients.