Áú»¢¶Ä²©

15 §°§Ô§â§Ñ§ß§Ú§é§Ö§ß§Ú§Ö §á§â§à§Ó§Ö§â§à§Ü §Ñ§Ô§Ö§ß§ä§Ñ

§°§Ò§Ù§à§â

§®§à§Ø§ß§à §à§Ô§â§Ñ§ß§Ú§é§Ú§ä§î §á§â§à§Ó§Ö§â§Ü§Ú §ß§Ñ §ã§ä§à§â§à§ß§Ö §Ñ§Ô§Ö§ß§ä§Ñ, §ã§à§Ù§Õ§Ñ§Ó §é§Ö§â§ß§í§Û §ã§á§Ú§ã§à§Ü §ï§Ý§Ö§Þ§Ö§ß§ä§à§Ó, §Ò§Ö§Ý§í§Û §ã§á§Ú§ã§à§Ü §Ú§Ý§Ú §Ü§à§Þ§Ò§Ú§ß§Ñ§è§Ú§ð §Ò§Ö§Ý§à§Ô§à/§é§Ö§â§ß§à§Ô§à §ã§á§Ú§ã§Ü§Ñ.

§¥§Ý§ñ §ï§ä§à§Ô§à §Ú§ã§á§à§Ý§î§Ù§å§Û§ä§Ö §Ü§à§Þ§Ò§Ú§ß§Ñ§è§Ú§ð §Ú§Ù §Õ§Ó§å§ç §á§Ñ§â§Ñ§Þ§Ö§ä§â§à§Ó §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú §Ñ§Ô§Ö§ß§ä§Ñ:

• ´¡±ô±ô´Ç·É°­±ð²â=&±ô³Ù;§ê§Ñ§Ò§Ý§à§ß&²µ³Ù; - §Ü§Ñ§Ü§Ú§Ö §á§â§à§Ó§Ö§â§Ü§Ú §â§Ñ§Ù§â§Ö§ê§Ö§ß§í; <§ê§Ñ§Ò§Ý§à§ß> §å§Ü§Ñ§Ù§í§Ó§Ñ§Ö§ä§ã§ñ §ã §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ß§Ú§Ö§Þ §Ó§í§â§Ñ§Ø§Ö§ß§Ú§ñ §ã §á§à§Õ§ã§ä§Ñ§ß§à§Ó§à§é§ß§í§Þ §Ù§ß§Ñ§Ü§à§Þ (*)
• ¶Ù±ð²Ô²â°­±ð²â=&±ô³Ù;§ê§Ñ§Ò§Ý§à§ß&²µ³Ù; - §Ü§Ñ§Ü§Ú§Ö §á§â§à§Ó§Ö§â§Ü§Ú §Ù§Ñ§á§â§Ö§ë§Ö§ß§í; <§ê§Ñ§Ò§Ý§à§ß> §å§Ü§Ñ§Ù§í§Ó§Ñ§Ö§ä§ã§ñ §ã §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ß§Ú§Ö§Þ §Ó§í§â§Ñ§Ø§Ö§ß§Ú§ñ §ã §á§à§Õ§ã§ä§Ñ§ß§à§Ó§à§é§ß§í§Þ §Ù§ß§Ñ§Ü§à§Þ (*)

§°§Ò§â§Ñ§ä§Ú§ä§Ö §Ó§ß§Ú§Þ§Ñ§ß§Ú§Ö, §é§ä§à:

• §£§ã§Ö §ï§Ý§Ö§Þ§Ö§ß§ä§í §Õ§Ñ§ß§ß§í§ç system.run[*] (§ã§Ü§â§Ú§á§ä§í, §å§Õ§Ñ§Ý§Ö§ß§ß§í§Ö §Ü§à§Þ§Ñ§ß§Õ§í) §á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð §à§ä§Ü§Ý§ð§é§Ö§ß§í, §Õ§Ñ§Ø§Ö §Ö§ã§Ý§Ú §ß§Ö §å§Ü§Ñ§Ù§Ñ§ß§í §Ù§Ñ§á§â§Ö§ë§Ñ§ð§ë§Ú§Ö §Ü§Ý§ð§é§Ú;
• §¯§Ñ§é§Ú§ß§Ñ§ñ §ã Áú»¢¶Ä²© 5.0.2 §á§Ñ§â§Ñ§Þ§Ö§ä§â §Ñ§Ô§Ö§ß§ä§Ñ EnableRemoteCommands:

   * §á§â§Ú§Ù§ß§Ñ§ß §å§ã§ä§Ñ§â§Ö§Ó§ê§Ú§Þ §Õ§Ý§ñ Áú»¢¶Ä²© §Ñ§Ô§Ö§ß§ä§Ñ
          * §ß§Ö §á§à§Õ§Õ§Ö§â§Ø§Ú§Ó§Ñ§Ö§ä§ã§ñ §Õ§Ý§ñ Áú»¢¶Ä²© §Ñ§Ô§Ö§ß§ä§Ñ 2

§±§à§ï§ä§à§Þ§å, §é§ä§à§Ò§í §â§Ñ§Ù§â§Ö§ê§Ú§ä§î §Ó§ã§Ö §å§Õ§Ñ§Ý§Ö§ß§ß§í§Ö §Ü§à§Þ§Ñ§ß§Õ§í, §å§Ü§Ñ§Ø§Ú§ä§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â AllowKey=system.run[*]. (§¥§à Áú»¢¶Ä²© 5.0.2, §Ó §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú §Ñ§Ô§Ö§ß§ä§Ñ §ä§Ñ§Ü§Ø§Ö §ä§â§Ö§Ò§å§Ö§ä§ã§ñ §å§Ü§Ñ§Ù§Ñ§ä§î EnableRemoteCommands=1.)

§¹§ä§à§Ò§í §â§Ñ§Ù§â§Ö§ê§Ú§ä§î §ä§à§Ý§î§Ü§à §ß§Ö§Ü§à§ä§à§â§í§Ö §å§Õ§Ñ§Ý§Ö§ß§ß§í§Ö §Ü§à§Þ§Ñ§ß§Õ§í, §ã§à§Ù§Õ§Ñ§Û§ä§Ö §Ò§Ö§Ý§í§Û §ã§á§Ú§ã§à§Ü §Ò§à§Ý§Ö§Ö §Ü§à§ß§Ü§â§Ö§ä§ß§í§ç §á§Ñ§â§Ñ§Þ§Ö§ä§â§à§Ó AllowKey[]. §¹§ä§à§Ò§í §Ù§Ñ§á§â§Ö§ä§Ú§ä§î §à§á§â§Ö§Õ§Ö§Ý§Ö§ß§ß§í§Ö §å§Õ§Ñ§Ý§Ö§ß§ß§í§Ö §Ü§à§Þ§Ñ§ß§Õ§í, §Õ§à§Ò§Ñ§Ó§î§ä§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§í DenyKey §á§Ö§â§Ö§Õ §á§Ñ§â§Ñ§Þ§Ö§ä§â§à§Þ AllowKey=system.run[*].

§£§Ñ§Ø§ß§í§Ö §á§â§Ñ§Ó§Ú§Ý§Ñ

• §¢§Ö§Ý§í§Û §ã§á§Ú§ã§à§Ü §Ò§Ö§Ù §á§â§Ñ§Ó§Ú§Ý§Ñ §Ù§Ñ§á§â§Ö§ë§Ö§ß§Ú§ñ §Ü§Ý§ð§é§Ö§Û §â§Ñ§Ù§â§Ö§ê§Ö§ß §ä§à§Ý§î§Ü§à §Õ§Ý§ñ §ï§Ý§Ö§Þ§Ö§ß§ä§à§Ó §Õ§Ñ§ß§ß§í§ç system.run [*]. §¥§Ý§ñ §Ó§ã§Ö§ç §à§ã§ä§Ñ§Ý§î§ß§í§ç §ï§Ý§Ö§Þ§Ö§ß§ä§à§Ó §á§Ñ§â§Ñ§Þ§Ö§ä§â§í AllowKey §ß§Ö §Õ§à§á§å§ã§Ü§Ñ§ð§ä§ã§ñ §Ò§Ö§Ù §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ñ DenyKey; §Ó §ï§ä§à§Þ §ã§Ý§å§é§Ñ§Ö Áú»¢¶Ä²© §Ñ§Ô§Ö§ß§ä §ß§Ö §Ù§Ñ§á§å§ã§ä§Ú§ä§ã§ñ §ä§à§Ý§î§Ü§à §ã §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ñ§Þ§Ú AllowKey.
• §°§é§Ö§â§Ö§Õ§ß§à§ã§ä§î §Ú§Þ§Ö§Ö§ä §Ù§ß§Ñ§é§Ö§ß§Ú§Ö. §µ§Ü§Ñ§Ù§Ñ§ß§ß§í§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§í §á§â§à§Ó§Ö§â§ñ§ð§ä§ã§ñ §á§à §à§é§Ö§â§Ö§Õ§Ú §Ó §ã§à§à§ä§Ó§Ö§ä§ã§ä§Ó§Ú§Ú §ã §á§à§â§ñ§Õ§Ü§à§Þ §Ú§ç §á§à§ñ§Ó§Ý§Ö§ß§Ú§ñ §Ó §æ§Ñ§Û§Ý§Ö §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú:
  • §¬§Ñ§Ü §ä§à§Ý§î§Ü§à §Ü§Ý§ð§é §ï§Ý§Ö§Þ§Ö§ß§ä§Ñ §Õ§Ñ§ß§ß§í§ç §ã§à§à§ä§Ó§Ö§ä§ã§ä§Ó§å§Ö§ä §â§Ñ§Ù§â§Ö§ê§Ñ§ð§ë§Ö§Þ§å/§Ù§Ñ§á§â§Ö§ë§Ñ§ð§ë§Ö§Þ§å §á§â§Ñ§Ó§Ú§Ý§å, §ï§Ý§Ö§Þ§Ö§ß§ä §â§Ñ§Ù§â§Ö§ê§Ñ§Ö§ä§ã§ñ §Ú§Ý§Ú §Ù§Ñ§á§â§Ö§ë§Ñ§Ö§ä§ã§ñ; §Ú §á§â§à§Ó§Ö§â§Ü§Ñ §á§â§Ñ§Ó§Ú§Ý §á§â§Ö§Ü§â§Ñ§ë§Ñ§Ö§ä§ã§ñ. §´§Ñ§Ü§Ú§Þ §à§Ò§â§Ñ§Ù§à§Þ, §Ö§ã§Ý§Ú §ï§Ý§Ö§Þ§Ö§ß§ä §ã§à§à§ä§Ó§Ö§ä§ã§ä§Ó§å§Ö§ä §Ú §â§Ñ§Ù§â§Ö§ê§Ñ§ð§ë§Ö§Þ§å §á§â§Ñ§Ó§Ú§Ý§å, §Ú §Ù§Ñ§á§â§Ö§ë§Ñ§ð§ë§Ö§Þ§å §á§â§Ñ§Ó§Ú§Ý§å, §â§Ö§Ù§å§Ý§î§ä§Ñ§ä §Ò§å§Õ§Ö§ä §Ù§Ñ§Ó§Ú§ã§Ö§ä§î §à§ä §ä§à§Ô§à, §Ü§Ñ§Ü§à§Ö §á§â§Ñ§Ó§Ú§Ý§à §Ò§å§Õ§Ö§ä §á§Ö§â§Ó§í§Þ.

  *§±§à§â§ñ§Õ§à§Ü §Ó§Ý§Ú§ñ§Ö§ä §ä§Ñ§Ü§Ø§Ö §ß§Ñ §á§Ñ§â§Ñ§Þ§Ö§ä§â EnableRemoteCommands (§Ö§ã§Ý§Ú §Ú§ã§á§à§Ý§î§Ù§å§Ö§ä§ã§ñ).
       * §±§à§Õ§Õ§Ö§â§Ø§Ú§Ó§Ñ§Ö§ä§ã§ñ §ß§Ö§à§Ô§â§Ñ§ß§Ú§é§Ö§ß§ß§à§Ö §Ü§à§Ý§Ú§é§Ö§ã§ä§Ó§à §á§Ñ§â§Ñ§Þ§Ö§ä§â§à§Ó AllowKey/DenyKey.
       * §±§â§Ñ§Ó§Ú§Ý§Ñ AllowKey, DenyKey §ß§Ö §Ó§Ý§Ú§ñ§ð§ä §ß§Ñ §á§Ñ§â§Ñ§Þ§Ö§ä§â§í §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú HostnameItem, HostMetadataItem, HostInterfaceItem.
       * §º§Ñ§Ò§Ý§à§ß §Ü§Ý§ð§é§Ñ - §ï§ä§à §Ó§í§â§Ñ§Ø§Ö§ß§Ú§Ö §ã §á§à§Õ§ã§ä§Ñ§ß§à§Ó§à§é§ß§í§Þ §Ù§ß§Ñ§Ü§à§Þ, §Ó §Ü§à§ä§à§â§à§Þ §á§à§Õ§ã§ä§Ñ§ß§à§Ó§à§é§ß§í§Û §Ù§ß§Ñ§Ü (*) §ã§à§à§ä§Ó§Ö§ä§ã§ä§Ó§å§Ö§ä §Ý§ð§Ò§à§Þ§å §Ü§à§Ý§Ú§é§Ö§ã§ä§Ó§å §Ý§ð§Ò§í§ç §ã§Ú§Þ§Ó§à§Ý§à§Ó §Ó §à§á§â§Ö§Õ§Ö§Ý§Ö§ß§ß§à§Û §á§à§Ù§Ú§è§Ú§Ú. §¦§Ô§à §Þ§à§Ø§ß§à §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §Ü§Ñ§Ü §Ó §Ú§Þ§Ö§ß§Ú §Ü§Ý§ð§é§Ñ, §ä§Ñ§Ü §Ú §Ó §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ñ§ç.
       * §¦§ã§Ý§Ú §Ü§à§ß§Ü§â§Ö§ä§ß§í§Û §Ü§Ý§ð§é §ï§Ý§Ö§Þ§Ö§ß§ä§Ñ §Ù§Ñ§á§â§Ö§ë§Ö§ß §Ó §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú §Ñ§Ô§Ö§ß§ä§Ñ, §ï§Ý§Ö§Þ§Ö§ß§ä §Ò§å§Õ§Ö§ä §à§ä§Þ§Ö§é§Ö§ß §Ü§Ñ§Ü §ß§Ö§á§à§Õ§Õ§Ö§â§Ø§Ú§Ó§Ñ§Ö§Þ§í§Û (§Ò§Ö§Ù §å§Ü§Ñ§Ù§Ñ§ß§Ú§ñ §á§â§Ú§é§Ú§ß§í);
       * §¡§Ô§Ö§ß§ä Áú»¢¶Ä²© §ã §á§Ñ§â§Ñ§Þ§Ö§ä§â§à§Þ §Ü§à§Þ§Ñ§ß§Õ§ß§à§Û §ã§ä§â§à§Ü§Ú --print (-p) §ß§Ö §Ò§å§Õ§Ö§ä §á§à§Ü§Ñ§Ù§í§Ó§Ñ§ä§î §Ü§Ý§ð§é§Ú, §Ü§à§ä§à§â§í§Ö §ß§Ö §â§Ñ§Ù§â§Ö§ê§Ö§ß§í §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ö§Û;
       * §¡§Ô§Ö§ß§ä Áú»¢¶Ä²© §ã §á§Ñ§â§Ñ§Þ§Ö§ä§â§à§Þ §Ü§à§Þ§Ñ§ß§Õ§ß§à§Û §ã§ä§â§à§Ü§Ú --test (-t) §Ó§Ö§â§ß§Ö§ä §ã§ä§Ñ§ä§å§ã %%"%% Unsupported item key. %%"%% (§¯§Ö§á§à§Õ§Õ§Ö§â§Ø§Ú§Ó§Ñ§Ö§Þ§í§Û §Ü§Ý§ð§é §ï§Ý§Ö§Þ§Ö§ß§ä§Ñ §Õ§Ñ§ß§ß§í§ç) §Õ§Ý§ñ §Ü§Ý§ð§é§Ö§Û, §Ü§à§ä§à§â§í§Ö §ß§Ö §â§Ñ§Ù§â§Ö§ê§Ö§ß§í §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ö§Û;
       * §°§ä§Ü§Ý§à§ß§Ö§ß§ß§í§Ö §å§Õ§Ñ§Ý§Ö§ß§ß§í§Ö §Ü§à§Þ§Ñ§ß§Õ§í §ß§Ö §Ò§å§Õ§å§ä §Ù§Ñ§á§Ú§ã§Ñ§ß§í §Ó §Ø§å§â§ß§Ñ§Ý §Ñ§Ô§Ö§ß§ä§Ñ (§Ö§ã§Ý§Ú LogRemoteCommands = 1).

§±§â§Ú§Þ§Ö§â§í §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ß§Ú§ñ

§©§Ñ§á§â§Ö§ä§Ú§ä§î §Ü§à§ß§Ü§â§Ö§ä§ß§å§ð §á§â§à§Ó§Ö§â§Ü§å

• §¥§à§Ò§Ñ§Ó§Ú§ä§î §Ó §é§Ö§â§ß§í§Û §ã§á§Ú§ã§à§Ü §Ü§à§ß§Ü§â§Ö§ä§ß§å§ð §á§â§à§Ó§Ö§â§Ü§å §ã §á§Ñ§â§Ñ§Þ§Ö§ä§â§à§Þ DenyKey. §³§à§à§ä§Ó§Ö§ä§ã§ä§Ó§å§ð§ë§Ú§Ö §Ü§Ý§ð§é§Ú §Ò§å§Õ§å§ä §Ù§Ñ§á§â§Ö§ë§Ö§ß§í. §²§Ñ§Ù§â§Ö§ê§Ö§ß§í §Ó§ã§Ö §ß§Ö§ã§à§Ó§á§Ñ§Õ§Ñ§ð§ë§Ú§Ö §Ü§Ý§ð§é§Ú, §Ü§â§à§Þ§Ö §ï§Ý§Ö§Þ§Ö§ß§ä§à§Ó system.run[].

§¯§Ñ§á§â§Ú§Þ§Ö§â:

# Deny secure data access
       DenyKey=vfs.file.contents[/etc/passwd,*]

§©§Ñ§á§â§Ö§ä§Ú§ä§î §Ü§à§ß§Ü§â§Ö§ä§ß§å§ð §Ü§à§Þ§Ñ§ß§Õ§å, §â§Ñ§Ù§â§Ö§ê§Ú§ä§î §Õ§â§å§Ô§Ú§Ö

• §¥§à§Ò§Ñ§Ó§Ú§ä§î §Ó §é§Ö§â§ß§í§Û §ã§á§Ú§ã§à§Ü §Ü§à§ß§Ü§â§Ö§ä§ß§å§ð §Ü§à§Þ§Ñ§ß§Õ§å §ã §á§Ñ§â§Ñ§Þ§Ö§ä§â§à§Þ DenyKey. §¥§à§Ò§Ñ§Ó§î§ä§Ö §Ó §Ò§Ö§Ý§í§Û §ã§á§Ú§ã§à§Ü §Ó§ã§Ö §à§ã§ä§Ñ§Ý§î§ß§í§Ö §Ü§à§Þ§Ñ§ß§Õ§í §ã §á§à§Þ§à§ë§î§ð §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ñ AllowKey.

# Disallow specific command
       DenyKey=system.run[ls -l /]
        
       # Allow other scripts
       AllowKey=system.run[*]

§²§Ñ§Ù§â§Ö§ê§Ú§ä§î §Ü§à§ß§Ü§â§Ö§ä§ß§å§ð §á§â§à§Ó§Ö§â§Ü§å, §Ù§Ñ§á§â§Ö§ä§Ú§ä§î §Õ§â§å§Ô§Ú§Ö

• §£§ß§Ö§ã§Ú§ä§Ö §à§á§â§Ö§Õ§Ö§Ý§Ö§ß§ß§í§Ö §á§â§à§Ó§Ö§â§Ü§Ú §Ó §Ò§Ö§Ý§í§Û §ã§á§Ú§ã§à§Ü §ã §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ñ§Þ§Ú AllowKey, §Ù§Ñ§á§â§Ö§ä§Ú§ä§Ö §Õ§â§å§Ô§Ú§Ö §ã §á§à§Þ§à§ë§î§ð DenyKey = *

§¯§Ñ§á§â§Ú§Þ§Ö§â:

# Allow reading logs:
       AllowKey=vfs.file.*[/var/log/*]
       
       # Allow localtime checks
       AllowKey=system.localtime[*]
       
       # Deny all other keys
       DenyKey=*

§±§â§Ú§Þ§Ö§â§í §ê§Ñ§Ò§Ý§à§ß§à§Ó

system.run and AllowKey

A hypothetical script like 'myscript.sh' may be executed on a host via Áú»¢¶Ä²© agent in several ways:

1. As an item key in a passive or active check, for example:

• system.run[myscript.sh]
• system.run[myscript.sh,wait]
• system.run[myscript.sh.nowait]

Here the user may add "wait", "nowait" or omit the 2nd argument to use its default value in system.run[].

2. As a global script (initiated by user in frontend or API).

A user configures this script in Administration ¡ú Scripts, sets "Execute on: Áú»¢¶Ä²© agent" and puts "myscript.sh" into the script's "Commands" input field. When invoked from frontend or API the Áú»¢¶Ä²© server sends to agent:

• system.run[myscript.sh,wait] - up to Áú»¢¶Ä²© 5.0.4
• system.run[myscript.sh] - since 5.0.5

Here the user does not control the "wait"/"nowait" parameters.

3. As a remote command from an action. The Áú»¢¶Ä²© server sends to agent:

• system.run[myscript.sh,nowait]

Here again the user does not control the "wait"/"nowait" parameters.

What that means is if we set AllowKey like:

AllowKey=system.run[myscript.sh]

then

• system.run[myscript.sh] - will be allowed
• system.run[myscript.sh,wait], system.run[myscript.sh,nowait] will not be allowed - the script will not be run if invoked as a step of action

To allow all described variants you may add:

AllowKey=system.run[myscript.sh,*] 
       DenyKey=system.run[*]

to the agent/agent2 parameters.