I'm writing a master-control script to control our infrastructure. Security is a major concern so I'd like to address two issues:
I want the user to be able to execute the application then be prompted to 'login' to the program using the root credentials on the system(Linux - Ubuntu). Failure to authenticate will trigger an email event and lock the program. Can I authenticate against /etc/passwd? And how can I lockout the application?
Second, how do I secure the application from modification? I may have to hard-code certain attributes into the application. What are the ideal permissions for a script to be executed but not edited?
While this is a non-trivial solution, the most secure way to do this is taking a client/server approach, making your master-control script a system service, only readable and runnable by root. You can fire up the service via init.d startup infrastructure.
When the service starts, you'd need to open a socket or RPC server to handle your control commands. On Python this can easily be done using Twisted.
To authenticate via /etc/passwd you can use the crypt and pwd Python modules.
Related
I have a small application built using python and tkinter, and I want that application to run on startup.
Here I have few questions
My question is how do I actually set the app to run at startup.
My application needs to login, but I don't understand how I can connect, application with database without placing database credentials in user's downloaded application.
There are 2 points here:
how to set-up an application to run at start-up?
If what you call startup if the machine startup before any user logs in, then the answer will depend on the OS. You will have rc scripts on Unix (and Unix-like) systems, or services on Windows.
how can an unattented application connect to the database?
A common way is to have the application run under a dedicated login (user name). Then you configure the database to accept passwordless connections from that specific login on that specific machine (ideally the same one). Of course that login should have the less possible privileges...
What platform do you want to do?
On Windows you can set your built (maybe .exe) in Task Scheduler.
press Start logo and Call Task Scheduler
Open it and Create task
and then setup what app do you want to run in Action tab and don't forget to Naming in General tab
On Linux I used to see somepeople follow this step you can follow from this link below :
How to Schedule Tasks on Linux: An Introduction to Crontab Files
Or you can search for Crontab to see how to setup task with Crontab commands
Today I'm dealing with a Python3 script that has to do a http post request and send a mail.
The Python script is launched on a Windows PC that is in a corporate network protected by Forefront.
The user is logged with his secret credentials and can access to the internet through a proxy.
Like the other non-Microsoft applications (i.e. Chrome), I want my script to connect to the internet without prompt the user for his username and password.
How can I do this?
On Microsoft OSes, the authentication used is Kerberos, so you won't be able to use directly your ID + password.
I'm on Linux, so I can't test it directly but I think that you can create a proxy with fiddler which can negociate the authentication for you, and you can use this proxy with python.
Fiddler's Composer will automatically respond to authentication challenges (including the Negotiate protocol which wraps Kerberos) if you tick the Authentication box on the Options subtab, in the menus.
I have created a web-app using Python Flask framework on Raspberry Pi running Raspbian. I want to control the hardware and trigger some sudo tasks on the Pi through web.
The Flask based server runs in non-sudo mode listening to port 8080. When a web client sends request through HTTP, I want to start a subprocess with sudo privileges. (for ex. trigger changes on gpio pins, turn on camera etc.). What is the best practice for implementing this kind of behavior?
The webserver can ask for sudo password to the client, which can be used to raise the privileges. I want some pointers on how to achieve this.
Best practice is to never do this kind of thing. If you are giving sudo access to your pi from internet and then executing user input you are giving everyone in the internet the possibility of executing arbitrary commands in your system. I understand that this is probably your pet project, but still imagine someone getting access to your computer and turning camera when you don't really expect it.
Create a separate process that does the actual work for you. You can run this process in the background with elevated privileges.
Your web client will just deposit tasks for this process in a queue. This can be as simple as a database to which your Flask app writes a "task request", the other, privileged process reads this request, performs the action, and updates the databases.
This concept isn't new, so there are multiple brokers and task queues that you can use. Celery is popular with Python developers and is easily integrated into your application.
I'm going to be using python to build a web-based asset management system to manage the production of short cg film. The app will be intranet-based running on a centos machine on the local network. I'm hoping you'll be able to browse through all the assets and shots and then open any of them in the appropriate program on the client machine (also running centos). I'm guessing that there will have to be some sort of set up on the client-side to allow the app to run commands, which is fine because I have access to all of the clients that will be using it (although I don't have root access). Is this sort of thing possible?
As you already guessed, you will need to have a service running on the client PC listening on a predetermined port.
When the client requests to open an asset, your webapp will send the request to the running service to download the asset and run it. As long as your port no. is above 1024 and you are not running any application which requires root access, you can run this service without root.
But this is a very bad idea as it exposes the clients to malicious attacks. You will have to ensure all requests to the client service is properly signed and that the client verifies each request as valid before executing it. There may be many other security factors you will have to consider depending on your implementation of the client service. But in general, having a service that can run arbitrary requests from a remote machine is a very dangerous thing to have.
You may also not be allowed to run such a service on client PC depending on your comany's IT policies.
You are better of having the client download the resource normally and then having the user execute the resource manually.
PS: You can have the client service run on a port below 1024, but it will have to start as root and after binding to the port drop all root privileges and change the running user to a different user using setuid (or the equivalent in your language of choice)
Note this is not a standard way. Imagine the websites out there had the ability to open Notepad or Minesweeper at their will when you visit or click something.
The way it is done is, you need to have a service which is running on the client machine which can expose certain apis and trust the request from the web apps call. this needs to be running on the client machines all the time and in your web app, you can send a request to this service to launch the application that you desire.
If you have a specific subset of applications that will be run on the client systems (aka you are distributing jobs), then you might want to consider python salt. It is a distributed RPC which uses a secure protocol and authentication to distribute jobs and deliver results:
http://docs.saltstack.org/en/latest/topics/index.html
If you are looking at automating content generation based on specific updates then you might want to consider Jenkins, which has plugins for various revision control systems and build systems:
https://wiki.jenkins-ci.org/display/JENKINS/Meet+Jenkins
It may not have integration with the particular tools you are using, but if it does then it could be a quicker setup and administration than generic salt automation.
--David
I would like to be able to use a Python script that I wrote to search files to login to an Ubuntu server that's password protected (which I have credentials ), and search files on that server.. Is there a straight forward way to accomplish this?
To login and run remote terminal commands through python, you should use either paramiko or pexpect. Pexpect is not touched very much by noah these days... I'm starting to wonder whether he is abandoning it.
The other way is to sftp the files from the remote server to your local machine... paramiko is useful for that as well.