CMD-GW(8)

NAME
cmd-gw - network diagnostic utilities shell

SYNOPSIS
cmd-gw [-daemon <port>] [-fastdaemon <port>] [-as <tag>]

DESCRIPTION
cmd-gw enables users to execute programs such as ping and traceroute on the gateway host by using telnet. A client program, cmd-tn , is also provided to simplify usage. Usage policy may be configured based on:

•   source IP address

•   source host name

•   command name

The CMD proxy (cmd-gw) generally runs as a daemon (invoked from system startup script, p.e. /etc/rc.local) and listens for requests on the specified port (tcp/32 is reasonable default). Whenever the system receives an connection request on this port, cmd-gw checks its configuration information (in the netperm-table) and determines whether the initiating host has permission to use the shell. If the host does not have permission, cmd-gw logs the connection attempt and displays an error message.

The proxy may also be invoked from tcp/ip "superserver" (inetd or xinetd). -daemon parameter should be omitted in this case.

If the host has permission, the proxy authenticates the user (if required), and executes commands on user's behalf.

OPTIONS

  Command Line Options
The gateway shell recognizes the following command line options (whether started from the command line or from within /etc/rc.local):

-daemon port
    Indicates that cmd-gw runs as a daemon, and the port (name or number) on which it listens. When -daemon option is used, configuration is being read from netperm-table for every new connection accepted by proxy.

    port Specifies either a numeric id or symbolic name from the /etc/services file.

-fastdaemon port
    Indicates that cmd-gw runs as a daemon, and the port (name or number) on which the proxy listens. When -fastdaemon option is used, configuration is being read from netperm-table once the daemon starts or if SIGHUP is received.

-as tag
    Changes default application tag for netperm-table from "cmd-gw" to any given string.

  Configuration Options
The proxy reads configuration rules from the /usr/local/etc/netperm-table. It reads all rules using the cmd-gw and * (wildcard) keywords. The proxy reads the netperm-table from top to bottom. If there are multiple rules in the table that could apply for a particular attribute, the proxy uses the first one that it finds. See netperm-table(5) for a more complete explanation of netperm-table syntax and precedence.

The proxy recognizes the following attributes:

authserver host port
    Specifies the host running the authentication server (and the port on which it runs) that the proxies use for authenticating users.

    host
        Specifies an IP address or host name.

    port
        Specifies a service name or port number.

hosts host-pattern [host-pattern2...] [options]
    rules specify host and access permissions. Typically, a hosts rule will be in the form of:

    cmd-gw: deny-hosts unknown

    cmd-gw: hosts 10.0.0.3 -commands *

    cmd-gw: hosts 10.0.0.0/255.255.255.0 -commands { ping traceroute }

    There may be several host patterns following the "hosts" keyword, ending with the first optional parameter beginning with '-'. Optional parameters permit the selective enabling or disabling of logging information, etc. Sub-options are:

    -authall specifies that the proxy should request authentication before providing the interactive shell.

    -cmd operation
    -cmd { operation1 operation2 ... }
    specifies operations allowed.

    -auth operation
    -auth { operation1 operation2 ... }
    specifies operations allowed once user authenticated itself.

    At least one of -auth , -cmd is mandatory, otherwise no commands will be permitted. Builtin commands are not subject of restrictions above, they are always available.

    -extnd specifies that the proxy should request per-operation permissions from authsrv.

groupid group
    Specifies the name of the group the proxy shell uses when running.

    group
        Specifies either a name or numeric id from the /etc/group file.

timeout seconds
    Specifies the number of seconds the shell is idle (with no network activity) before disconnecting

userid user
    Specifies the user ID the proxy uses when running.

    user
        Specifies either a name or numeric id from the /etc/passwd file. This option is equivalent to the -user command in previous versions.

  Shell Commands

help
    Displays a list of valid proxy commands.

?   Alias for help.

quit
    Exits the shell.

exit
    Alias for quit

auth [<username>]
    Authenticate user

login [<username>]
    Alias for auth

dig <host>
    Execute dig command

finger [<user@>]<host>
    Execute finger command

ping <host>
    Execute ping command

traceroute <host>
    Execute traceroute command

once <command> [<arg>..]
    Execute one command and quit

EXAMPLES
Sample interactive session providing ping command via proxy.

    paranoid.alpha.int $ telnet firewall 32
    Trying 192.168.0.1...
    Connected to firewall.alpha.int.
    Escape character is '^]'.
    Welcome to cmd-gw.
    Command: ping www.google.com
    PING www.l.google.com (209.85.135.147) 56(84) bytes of data.
    64 bytes from mu-in-f147.google.com (209.85.135.147): icmp_seq=1 ttl=244 time=67.4 ms
    64 bytes from mu-in-f147.google.com (209.85.135.147): icmp_seq=2 ttl=244 time=67.6 ms
    64 bytes from mu-in-f147.google.com (209.85.135.147): icmp_seq=3 ttl=244 time=68.9 ms
    ^C
    --- www.l.google.com ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2000ms
    rtt min/avg/max/mdev = 67.451/68.027/68.957/0.663 ms
    Command:

FILES

/etc/rc.local
    Command script that controls automatic reboot, and includes startup information for the cmd-gw.

/usr/local/etc/netperm-table
    The network permissions file contains configuration information for the Firewall Toolkit, including cmd-gw.

BUGS
cmd-gw is only as safe as your dig, finger, ping, and traceroute clients are. If these have some way for running a program named on the command line or for compromising the gateway host in other ways, you're in trouble. Otherwise, cmd-gw should be safe. At least, it's safer than telnetting into the gateway host to issue the commands.

Note that the finger command will allow anyone who is allowed access to cmd-gw to find out who's working on the gateway host (of course, noone should be working on the gateway host).

chroot operation is not fully supported at the moment. You may try to set it up, but it is on your own risk.

Command list is fixed and defined at compile time. Consider that a security feature, not a bug.

Fully featured telnet server is not implemented, nor pty allocation is. So you cannot run curses-based programs or ones that require password to be entered in no-echo mode. This feature is not planned to be included in this gateway; we plan to create a more functional (and, obviously, less secure ;-) restricted shell as a separate program.

Report bugs to arkenoi@gmail.com or fwtk-users@buoy.com mailing list. Include a complete example, explaining what you expected to happen and what actually happened. Be sure to indicate the type of system (operating system, hardware, etc.) you are using, as well as the version of cmd-gw.

AUTHOR
Eberhard Mattes.

SEE ALSO
netperm-table(5), rc(8), authsrv(8), netacl(8)