Shutting down a firewall remotely via a password less script

[dastrix80 (Kris K)]

yes , under visudo
openhab ALL=(ALL) NOPASSWD: ALL

[rossko57]

@dastrix80

prints nothing im afraid.

As said, that suggests your rule may not be running. Why not find out?

rule "Shutdown Firewall"
when
        Item shutdownfirewall changed to ON
then
      logInfo("exectest", "rule triggered")
...

Thinking on it, another possibility for failing to get to the other logInfo is that the script call never returns.
You should add a timeout to your call, so it cannot wait forever.

var result = executeCommandLine("sudo ... halt" , 5000)

This is always a good idea, in any circumstance.

[dastrix80 (Kris K)]

@dastrix80

var result = executeCommandLine(“sudo ssh@@nsautomate@192.168.1.254@@sudo@@/etc/rc.halt”)

thanks rossko, now I get this

19:54:19.089 [INFO ] [lipse.smarthome.model.script.exectest] - results- sudo: sorry, you must have a tty to run sudo

edit: turn of requiretty in the visudo has removed that error… still not working, but getting closer

[rossko57]

I’ve no idea, but wanting a tty suggests to me that the underlying reason is that it wants a password.

[dastrix80 (Kris K)]

which is odd given visudo is correct

[rossko57]

You seem to have been around a lot of this area before. This is sort of related, regarding two sudo for different users.

[SOLVED] Openhab 2 and executeCommandLine / Exec

You are missing a sudo. The sudo -u openhab part of the line runs the script as the openhab user. Then you want to run sudo openhab-cli backup to start as the openhab user and test that openhab can call that script with sudo. sudo -u openhab sudo openhab-cli backup

[dastrix80 (Kris K)]

Yeah this is different in that im executing a command as openhab, but logging in as another user. This is non interactive. Different to the example in the link youve posted

[marcel_erkel]

Why do you run the ssh command using sudo (sudo ssh ....)? There should be no need to do so. The ssh client is executed on your local openHab node, not on the pfsense node.

When generating the private/pub keys, were you logged in as user openhab?

[marcel_erkel]

@ei_Gelb_Geek

sudo ssh-keygen -t rsa
sudo ssh-copy-id -i /root/.ssh/id_rsa.pub kris@192.168.1.254

Unless you run openHAB as user root (which you shouldn’t), this will not work. Normally, openHab will run as user openhab so you will need to generate the private/public key pair as user openhab (at least that is the easiest way to do it since they will then end up in the correct home directory). If your running openhabian, then the home directory for the openhab user is not /home/openhab/…

[ei_Gelb_Geek (Kevin)]

The way works … because root has the ssh-keys & user openhab have access to sudo

[marcel_erkel]

@ei_Gelb_Geek

openhab ALL=(ALL) NOPASSWD: ALL

I’m going to quote Rich here:

@rlkoshak

• Someone can add a Rule through the REST API.
• A Rule can call executeCommandLine.

You can guess the rest.

Anyone reading this who cannot ‘guess the rest’ should not follow the advise given in this thread. Anyone who can ‘guess the rest’ will understand that he/she should not follow the advise given in this thread.

[rlkoshak (Rich Koshak)]

I think marcel was correct to post that quote.

The whole idea of computer security is defense in depth. Why don’t we just run everything as root all the time? Why don’t we just log in as root instead of needing to sudo all the time? Why is there a a firewall on the host machine? Why are there file permissions?

It’s ALL to make it more difficult for an attacker to compromise a machine and to limit what they can do on a given machine if they are successful.

When you give the openhab user no password permission to run all commands, you may as well just run openHAB as root. When you run openHAB as root, if someone compromises the machine or compromises your account on myopenhab.org, they can literally do anything on your machine.

So no, the need to protect and limit what the openhab user can do is not limited to just those who expose their OH to the internet. That quote is applicable here as well as to the other thread. It’s a bad idea to give openHAB blanket sudo permissions. It’s a bad idea to run openHAB as root. And honestly, IMHO, it’s a bad idea to install and use the Exec binding. If I could, I’d disable the executeCommandLine Action too. Since I can’t, I rely on the Docker container to limit the damage that can be done should my openHAB get compromised.

[dastrix80 (Kris K)]

I got this working, ill post my solution today

[ei_Gelb_Geek (Kevin)]

Yes I agree with you, of course sudo can be a problem, but other mistakes have to be made that it becomes dangerous. Smarthome and other critical applications should run in an isolated network.

Even without sudo, a compromised openhab is not a good scenario!

If we now create ssh-keys for the user Openhab to the firewall, then it would work (without the sudo problem on the OH system) But the whole thing would be a security problem, because if Openhab is attacked, one would be able to log in to the firewall. On the firewall we have sudo right again …

I think we should start with the safety in other places!

[rlkoshak (Rich Koshak)]

@ei_Gelb_Geek

I think we should start with the safety in other places!

Securing a system is a wholistic activity. You don’t start here and ignore over there. And building a fort around your network and solely relying on that for your security is never sufficient.

@ei_Gelb_Geek

The biggest security issue in my opinion is trying to control everything through openhab.

I think this is my main point. It’s not just the sudoers that I have a problem with. The entire scenario is shady as hell and i’d have my credentials revoked if I ever suggested anything remotely like this scenario professionally.

So what would be an alternative if you just had to control a firewall from OH? What if you installed a daemon on the firewall that you can attentive with and only allows this one command? Then you are not exposing your OH machine itself through the executecommandline and sudo not are you necessarily exposing the firewall in the same way, particularly if the shutdown command is modified to allow what ever non privileged user the daemon ribs as to issue the shutdown command.

But that’s more work.

[ei_Gelb_Geek (Kevin)]

I have revoke the Posting … all happy now?

[ei_Gelb_Geek (Kevin)]

@rlkoshak

The entire scenario is shady as hell and i’d have my credentials revoked if I ever suggested anything remotely like this scenario professionally.

Now its your turn!

@rlkoshak

How to Debug

Some easy steps:

• If the command or the called script calls sudo , make sure openhab is a member of sudoers and is configured with NOPASSWORD

@rlkoshak

Using sudo but failing to add the openhab user to sudoers with NOPASSWORD. If you are on the raspbian probably the easiest thing to do is run sudo visudo and copy what is there for the pi user and change “pi” to “openhab”

How to solve Exec binding problems

One of the most common problems I help people with on this forum is dealing with the Exec binding. So I’m writing this post so I can reference it later. Background When openHAB is installed in the automated way (i.e. via apt-get) an openhab user is created and the service runs under that user. The openhab user has the following attributes: no shell so one cannot log in or su to this user limited rights not a member of sudoers has a home directory in /var/lib/openhab (or /var/lib/openhab2) has…

[rlkoshak (Rich Koshak)]

But here is the big difference. I’m not advocating giving some service which has some exposure to the outside world (through myopenhab.org) running inside a LAN permission to log into the firewall, the thing that protects your LAN from attack, and change the firewall’s settings in those posts. That’s the shady part. That’s locking your door but leaving the key under the welcome mat.

Giving openHAB sudo permission with no password, on specified commands, while not particularly safe, is no where near as risky as that. So I have no qualms about giving advice on how to set up the openhab user to use sudo.

[ei_Gelb_Geek (Kevin)]

@rlkoshak

But here is the big difference. I’m not advocating giving some service which has some exposure to the outside world (through myopenhab.org) running inside a LAN permission to log into the firewall, the thing that protects your LAN from attack, and change the firewall’s settings in those posts. That’s the shady part. That’s locking your door but leaving the key under the welcome mat.

Giving openHAB sudo permission with no password, on specified commands , while not particularly safe, is no where near as risky as that. So I have no qualms about giving advice on how to set up the openhab user to use sudo.

Rich I did not do anything else! I have nothing connected with the outside world! I have suggested the same as you in connection with the Exec Binding!

I do not suggest to connect a service with the outside world. Here are the lines I suggested:

Here my results … it works

ToDo:

sudo ssh-keygen -t rsa
sudo ssh-copy-id -i /root/.ssh/id_rsa.pub kris@192.168.1.254

sudo nano -f /etc/sudoers.d/010_pi-nopasswd

openhab ALL=(ALL) NOPASSWD: ALL

sudo /etc/init.d/sudo restart

sudo nano /etc/openhab2/rules/shutdown.rules

rule "Shutdown Firewall"
  when
      Item shutdownfirewall changed to ON
  then
      shutdownfirewall.postUpdate(OFF)
      Thread::sleep(100)
      executeCommandLine("sudo bash /etc/openhab2/scripts/shutdown.sh")
  end

sudo nano /etc/openhab2/scripts/firewall_shutdown.sh

  #!/bin/bash
  ssh kris@192.168.1.254 'sudo shutdown -h now'

sudo chown openhab:openhab /etc/openhab2/scripts/firewall_shutdown.sh
sudo chmod u+x /etc/openhab2/scripts/firewall_shutdown.sh

[ei_Gelb_Geek (Kevin)]

@rlkoshak

When you give the openhab user no password permission to run all commands, you may as well just run openHAB as root. When you run openHAB as root, if someone compromises the machine or compromises your account on myopenhab.org, they can literally do anything on your machine.

So no, the need to protect and limit what the openhab user can do is not limited to just those who expose their OH to the internet. That quote is applicable here as well as to the other thread. It’s a bad idea to give openHAB blanket sudo permissions. It’s a bad idea to run openHAB as root. And honestly, IMHO, it’s a bad idea to install and use the Exec binding. If I could, I’d disable the executeCommandLine Action too. Since I can’t, I rely on the Docker container to limit the damage that can be done should my openHAB get compromised.

@rlkoshak

Giving openHAB sudo permission with no password, on specified commands , while not particularly safe, is no where near as risky as that. So I have no qualms about giving advice on how to set up the openhab user to use sudo.

???

You contradict yourself there?

First you say sudo is a bad idea and later you say that you have no problem with sudo for openhab …