Secure way to let people execute a single command on my servers shell? reddit / selfhosted ---------------------------------------------------------------------- Generic_User48579 · 2023-12-28 11:23 Hi, I have a few LinuxGSM servers running on my homelab. Some of them are rarely used, like a day or two a month. The server is started using a command like so (minecraft example): `./mcserver start` as the user `mcserver`. I don't want people have to contact me to start up the server and play, so it would be great if people could somehow trigger this command at their leisure. I thought of a simple webpage with a button, or a discord bot that people can dm and it executes it, but I'm not sure that's the best way and also worried about RCE vulns and stuff like that (though the discord bot should be relatively secure). What are possible ways to do this? What is the *best* way in your opinion? ---------------------------------------------------------------------- CubeCoders · 2023-12-28 11:31 You'd have to move away from LinuxGSM and use an actual control panel to let users have access to a limited subset of server functions via a Web interface. LGSM doesn't have any kind of provision for letting other people access your servers without giving them the keys to the kingdom. Look at options like AMP and Pterodactyl which let you give users limited access to users to start/stop servers without any other access. ---------------------------------------------------------------------- Sekhen · 2023-12-28 11:38 Give you the command to execute. ---------------------------------------------------------------------- Sekhen · 2023-12-28 11:40 Just let it stay up. An empty minecraft server doesn't really do anything. All simulations stop. ---------------------------------------------------------------------- sebasdt · 2023-12-28 11:42 Or use Minecraft server stopper and sleeper.. ---------------------------------------------------------------------- RedditSlayer2020 · 2023-12-28 11:47 simple php webpage coupled with a cronjob will do ---------------------------------------------------------------------- Simon-RedditAccount · 2023-12-28 11:55 [https://github.com/OliveTin/OliveTin](https://github.com/OliveTin/Oli veTin) \+ maybe some kind of auth at reverse proxy. Bots are very actively touching everything on public IPs, so introduce at least HTTP basic auth with something like `mcuser/mcpass` to stop them (yeah, most bots actually never try to bruteforce HTTP Basic auth). ---------------------------------------------------------------------- AceHighness · 2023-12-28 11:59 To be sure you can use 1 u printable character in your password such as ALT-255 ---------------------------------------------------------------------- Generic_User48579 · 2023-12-28 12:13 Its more about wasted resources. Many servers have a sleep function when no one is playing but some do not. And If I have like 10+ servers running, where only two are constantly used while the others are occasional, it would be great to have them be able to be started up remotely. ---------------------------------------------------------------------- Generic_User48579 · 2023-12-28 12:15 This seems like exactly what Ive been looking for, thank you! ---------------------------------------------------------------------- lilolalu · 2023-12-28 12:22 https://manpages.ubuntu.com/manpages/jammy/man1/restricted-ssh- commands.1.html restricted-ssh-commands is intended to be called by SSH to restrict a user to only run specific commands. A list of allowed regular expressions can be configured in /etc/restricted-ssh-commands/. The requested command has to match at least one regular expression. Otherwise it will be rejected. restricted-ssh-commands is useful to grant restricted access via SSH to do only certain task. For example, it could allow a user to upload a Debian packages via scp and run reprepro processincoming. The optional config parameter is the name of the configuration inside /etc/restricted-ssh-commands/ that should be used. If config is omitted, the user name will be used. ---------------------------------------------------------------------- Agile_Ad_2073 · 2023-12-28 13:04 If you have the servers running as VMS in proxmox. You can create a small script that can call the proxmox API to turn on and of the specific VM. ---------------------------------------------------------------------- geo38 · 2023-12-28 13:40 Thanks for the tips ---------------------------------------------------------------------- DrAg0n141 · 2023-12-28 13:56 I use OliveTin for that too, and in front Authelia for the authentication. ---------------------------------------------------------------------- Sirpigles · 2023-12-28 14:11 You can use a server management interface like Crafty Controller. Which would let you make logins for the users that they could use to login to the website and start up your server. ---------------------------------------------------------------------- draxxus1549 · 2023-12-28 15:17 I assume all the players have/use discord, writing a simple discord bot to handle starting and stopping the servers might be a good way to go. No managing auth, ssh keys or anything like that. ---------------------------------------------------------------------- RumbleStripRescue · 2023-12-28 16:17 This is paint-by-numbers RCE ---------------------------------------------------------------------- ComputerHippiePanda · 2023-12-28 17:55 Do it in game trough https://github.com/timvisee/lazymc ---------------------------------------------------------------------- michaelpaoli · 2023-12-28 18:05 >Secure way to let people execute a single command on my servers shell? ssh forced command >as the user mcserver Likewise, utilizing sudo, that way you also know who authenticated to run the command And all that at least presuming you actually care to know who authenticated to run the command (and from what IP and port). And for better security, ssh keys only, no (matchable) passwords. ---------------------------------------------------------------------- SadSssassin · 2023-12-28 19:01 Why not just setup a basic proxy that listens to incoming traffic for a server instance and starts it when someone tries to connect? ---------------------------------------------------------------------- 94711c · 2023-12-28 19:18 Have you looked into the `ForceCommand` option in ssh? TL;DR you can set up a ssh server where users belonging to a particular group can not log on with an interactive prompt, but when they log on, a command is executed. ---------------------------------------------------------------------- Tresillo_Crack · 2023-12-28 19:34 Theres a proxy that runs behind the minecraft server that uses low ram and cpu and when a user joined the minecraft server it will turn it on so people can play on demand instead of having it open 24/7. Or you can just run pterodactyl which might be difficult at first but it's worth it. ---------------------------------------------------------------------- blikjeham · 2023-12-28 19:40 You can have a webserver that places a file in a specific location if you press the button. Then use a cron job to see if the file exists en start the server and remove the file again. This way you disconnect the webserver from the part that is running commands on your system. ---------------------------------------------------------------------- FrumunduhCheese · 2023-12-28 19:43 Not if you run specific mods ---------------------------------------------------------------------- jypelle · 2023-12-28 20:15 - Install Ctfreak (Free Edition is enough) - Add your users - Add an *SSH credential* to connect to your server - Add your server as an *internal node* - Create a project - Create a "bash script" task to execute `./mcserver start` on your server through ssh - Edit Project Access to add your users as *executor* ->Users whom you have assigned to your project as *executors* will only be able to log in to ctfreak through their browser, launch your project's tasks, and that's it! At no point will they have direct access to SSH keys, your server, ... ---------------------------------------------------------------------- colin_colout · 2023-12-28 22:48 This is the way. Have an allow list of discord user names and you're good ---------------------------------------------------------------------- gentoofoo · 2023-12-28 23:24 might actually be a decent application for port knocking, check out knockd ---------------------------------------------------------------------- RedditSlayer2020 · 2023-12-29 00:02 I am assuming that you know what you are doing when you enter that terrain. Your answer is like suggesting you should use a car with breaks if you consider driving. Thank for your cautious suggestion ♥ ---------------------------------------------------------------------- Specific-Action-8993 · 2023-12-29 00:06 If the server has wake-on-lan configured you could make an instance of [upsnap](https://github.com/seriousm4x/UpSnap) available. It let's you configure users with access to specific machines only and has built-in auth. For added security you could put it behind a cloudflare tunnel OTP with configured with your users' email addresses. ---------------------------------------------------------------------- geolaw · 2023-12-29 01:11 Simple php script to display a list of functions and then give the commands via a system call or something. I toggle my dlna server on and off this way (actually does a ssh call to execute a script which looks for minidlna running, if it is it does a systemctl stop minidlna, otherwise systemctl start minidlna. Could just as well do a 'virsh start vm" ---------------------------------------------------------------------- spottyPotty · 2023-12-29 01:36 Look into the documentation of the format of the lines that go in authorized_keys file. You should be able to do exactly what you need there. ---------------------------------------------------------------------- G0pherB0y · 2023-12-29 01:48 I did basic http auth to a diy process queue. The command in 1 table referenced by id only. The button only knows the id. The queue runner ran on a different server. ---------------------------------------------------------------------- miztertea1 · 2023-12-29 02:33 This sounds like a great use case for https://www.windmill.dev. You could build workflows, apis, or just access to execute certain bash scripts within the tool and who has access to what. ---------------------------------------------------------------------- s717737 · 2023-12-29 06:28 Create a regular user for this, and then create a new entry in sudoers file using visudo. for example you can allow that user only to reboot or suspend the pc using sudo. ---------------------------------------------------------------------- stappersg · 2023-12-29 11:52 _Show us the `source code`_ ---------------------------------------------------------------------- makuzzle · 2023-12-29 16:31 Far from a hacker but interested in the scenario here: assuming the php script is hardcoded to run a specific cronjob at the click of a button. Except for hammering the button an using it for a DoS attack - how would this setup allow the attacker to run arbitrary code? Genuinely interested, not a smart ass. Is it because we consider it a given that there is always a php script on any webserver that uses unsanitized inputs, and once we allow the php process to start cron jobs, we open the flood gates? Or is my initial assumption already the "know what you're doing"-part? ---------------------------------------------------------------------- Kharmastream · 2023-12-29 17:22 Add his account and permitted commands to the sudoers config