1

I have setup a web server that hosts a Play! Framework application, the server is an Amazon Linux EC2.

If you are not familiar with Amazon Linux, by default there is a root user and an ec2-user with sudo privileges. To access the server you ssh in as the ec2-user using a key, passwords are disabled.

I want this application to be as secure as possible, and this setup seemed insecure to me; if someone is able to get the ssh key they will have root access to the machine.

To harden the server I added a new user "Play". I store and run the application from the Play users home folder. I then removed the sudo command from the ec2-user and added a password to root.

So now I login via ssh as the ec2-user who has no sudo privileges, then switch to the root/Play user to make any changes or do work on the server.

This seems like a fairly secure solution, however I would like to take it one step further: I want to limit the user I use to log in as (ec2-user) to only 1 command: "su - ". This is all I will be using this user for: switching to root.

For reference these are the commands I ran for this setup:

sudo su -

Added password to root:

passwd

Added Play user:

sudo adduser Play

Remove ec2-user from sudoers

cd /etc/sudoers.d
nano cloud-init

Remove ec2-user and update file to:

Play    ALL= NOPASSWD: ALL
# User rules for ec2-user
Play    ALL=(ALL) NOPASSWD:ALL

thanks in advance for your help/advice!

5

Removing access to other commands than su, will not inherently make your system more secure.

First off you will not be able to prevent internal commands from running if you assign the user to known shell, except likes of rbash but rbash itself is a little more permissive and allow user to run some commands. If you can make a peace with that, you can use it.

Another not so secure but workable solution is to define the user's default shell as a script and this script to have su - and exit commands in it and nothing else, other than trapping break-out sequences like ctrl-c or ctrl-z. This is called captive interface. You also need to put this script with its full path at the end of the /etc/shells. Since it is a script, it has all the security ramifications that come with that, present or future.

  • thank you for your response, I think I am going to re think what I am doing here.... – DominoSugar Apr 10 '16 at 11:07
  • (0) I believe that the OP is talking about a security-in-depth setup, basically two-factor authentication, where the only way to login to the system is to login as ec2-user using an ssh key, and then the only thing ec2-user can do is run su -, which requires a password.  But I don’t understand why he thinks “an attacker getting the ssh key” is a serious risk.  (Perhaps he suspects that his home system has been compromised.)  I’m also confused about the new user called “Play” — Does it have UID 0?  Is it possible to login directly to “Play”? and if so, how?  … (Cont’d) – Scott Apr 14 '16 at 4:59
  • (Cont’d) …  (1) If a user’s .profile, .bashrc, or whatever, runs a command, there is a risk that the user can escape to a shell with Ctrl+C or Ctrl+Z.  But how is there a risk if the user’s login shell is set to be a script?  (2) Why do you recommend adding special, custom “login shells” to /etc/shells? – Scott Apr 14 '16 at 5:00
  • And then there are always backdoors like allowing commands that prevent shell escaping. I would rethink that security model. – Rui F Ribeiro Apr 4 '18 at 10:14
-1

What you could do is implement some form of ACL (Access Control List).

I mentioned in my previous comments that I think OP's idea is the same as mine which is to add another layer of security by having users SSH as a restricted account. Then use a password to su to another account that has more privilege but it was deleted.

If you want to restrict what the user ec2-user does. Firstly make sure they're not in the sudoers group.
By default they'll still have read permission on most files in the system, but they won't be able to elevate their privilege to edit them or read files that aren't world readable.

I found a number of solutions including setting ec2-user in chroot which will restrict them to a certain directory using STFP. This solution might not be the best fit as you need ec2-user to be able to su and change the directory from /home/ec2-user to /home/play, I assume.

The best solution in my opinion is to apply ACL. This is a way to restrict the commands users can execute in the shell.
It works by using the command setfacl and removing the read and execute permissions for a user in the /bin file.

setfacl -m u:ec2-user:r /bin/more -m: to add read read access to the user. u: user, can be changed to g(group) or o(other). ec2-user: the user r: give the user only read permission.

This example will remove write and execution permission for the more bash file. This is not the best method as you'd have to remove the commands you don't want them to use instead of only allowing them to use su. However, it is the fastest and easiest method I could find.

  • 2
    This site is regulated by the community not by moderators, the moderators has special priviledge but everybody could have enough privileges to edit remove delete answers question comments... All you need is more reputation. please don't be salty. Also comments are not meant to last in time and might be deleted to clarify situations or sometimes because they are considered useless. If you have a solution please share it as a solution next time and if it's good it might even get upvoted. – Kiwy Apr 5 '18 at 9:50
  • Easy to say that from your tower of reputation. do1. – Nmap2myHeartBeat Apr 5 '18 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.