Results 1 to 30 of 30
  1. #1

    Jailed Shell Safe?

    What do you think? I am thinking about offering this to my clients as a free bonus.

  2. #2
    Join Date
    Mar 2008
    Posts
    1,717
    For the most part, your server should be secured as if everyone already had shell access to begin with. There should be minimal risk involved in enabling shell access, but I would personally only enable it for folks who ask for it.
    I used to run the oldest commercial Mumble host.

  3. #3
    Join Date
    Apr 2005
    Location
    Cochin
    Posts
    2,446
    depends on familiarity with your customers. If you know them pretty well, there is no harm in giving it away. Otherwise my suggestion is a NO
    Sam
    Supportlobby.com - Expertise in Windows/Linux server support, IaaS and PaaS Management
    Spiralbean.com - Custom Software Development
    Email: exec @ activelobby.net | Skype: unni_active

  4. #4
    Join Date
    May 2009
    Location
    SLASH ROOT
    Posts
    853

  5. #5
    Join Date
    Jun 2006
    Location
    NYC
    Posts
    1,446
    I normally wouldn't do it. Especially on Linux. FreeBSD is ok. Depends on your OS.

    Either way, better make sure it is hardened
    FiberPeer.Com | | REAL DDoS Protection | Cloud Hosting | VPS | Dedicated Servers | High Bandwidth Hosting | 1Gbps-10Gbps Unmetered
    FiberPeer DDoS Mitigation | ethProxy Upgraded! | 14-Years Experience | Emergency 24/7 Support
    Visit us @ www.fiberpeer.com

  6. #6
    Join Date
    Apr 2009
    Location
    whitehouse
    Posts
    656
    Also, disable GCC for the users and you should be pretty safe.
    James B
    EzeeloginSetup your Secure Linux SSH Gateway.
    |Manage & Administer Multiple Linux Servers Quickly & Securely.

  7. #7
    Join Date
    Jul 2009
    Posts
    178
    jailshell will not harm your server security as it has less features compared to bach shell.

  8. #8
    I submitted a ticket to cPanel.

    cPanel said:
    Jailshell is safer than a normal shell because it is a restricted environment (compared to bash or another full shell). But of course it's still a shell on the system, so caution should be taken. People try to run IRC bots, compile programs, you get the idea. You should be selective when giving it out. It's jailed but that doesn't mean it's impossible to get out of - even full linux chroots can be broken in some cases, there are bugs in software from time to time. I recommend not giving out shells to everyone, but only when necessary.

  9. #9
    Join Date
    Aug 2009
    Posts
    53
    One way to ensure proper useage is to only enable it to people who request it and have them provide some sort of identification. It also dont hurt to ask why they need it, and if you can find another way around without using SSH.

  10. #10
    Jail shell is perfectly safe.
    Eleven2 Web Hosting - World-Wide Hosting, Done Right!

  11. #11
    Join Date
    Jun 2006
    Location
    NYC
    Posts
    1,446
    Quote Originally Posted by SharkSpace View Post
    Jail shell is perfectly safe.
    right... Until a buffer overflow exploit... kind of like the 3 that came out this month for linux, drops you to a normal/root shell
    FiberPeer.Com | | REAL DDoS Protection | Cloud Hosting | VPS | Dedicated Servers | High Bandwidth Hosting | 1Gbps-10Gbps Unmetered
    FiberPeer DDoS Mitigation | ethProxy Upgraded! | 14-Years Experience | Emergency 24/7 Support
    Visit us @ www.fiberpeer.com

  12. #12
    Join Date
    Aug 2009
    Location
    Orlando, FL
    Posts
    1,063
    I like most people agree. If they don't ask for it, don't provide it. People could change their password to something stupid like "welcome." A dictionary attack would have that in no time.

  13. #13
    Join Date
    Feb 2004
    Location
    UK
    Posts
    1,429
    I personally would never allow it, you just never know what exploit is around the corner.

  14. #14
    Join Date
    Mar 2007
    Location
    United Kingdom
    Posts
    181
    On a shared server, this is a complete no-no for the reasons others already stated. Most shared clients should not require this functionality, and very few will know how to make good/safe use of it.

    These days, generally clients who want this level of access are the ones who are interested in running their own server so they're quite likely to purchase a budget VPS for similar money to your shared hosting service - so except for opening yourself up to more possibility of security threats I don't see the benefit?
    UK, Chicago, & Singapore Fully Managed Cloud VPS
    UK & Arizona Jelastic Java, PHP & Ruby PaaS

    Comprehensive SLAs, backups, full SSD, rebootless kernel updates.
    Experienced managed hosting provider since 2001. True 24x7 Support & Server Management

  15. #15
    If the user needs it, have them provide a valid reason and be suspicious.

  16. #16
    Join Date
    Mar 2007
    Location
    United Kingdom
    Posts
    181
    Quote Originally Posted by BillabongRob View Post
    If the user needs it, have them provide a valid reason and be suspicious.
    Yes, except that suspicion doesn't help after said (potentially malicious) user causes severe damage to the server after exploiting a jailbreak vulnerability etc.

    There is no concrete good reason for a shared/reseller customer to need SSH access. However, if they actually do have some genuine reason then they'll be best suited to a VPS of one nature or another.

    Ask the same question 10-15 years ago and maybe you get "allow SSH access to trusted people if you're really careful about it" - since VPS's are everywhere now it just doesn't make sense for providers and customers to take this risk; there are similarly priced products far better suited to this set of requirements (and the "requirements" are usually preference rather than a technicality).

    Advice to consumers: be concerned if your shared/reseller host offers SSH access - it could lead to security/reliability issues affecting your service!
    UK, Chicago, & Singapore Fully Managed Cloud VPS
    UK & Arizona Jelastic Java, PHP & Ruby PaaS

    Comprehensive SLAs, backups, full SSD, rebootless kernel updates.
    Experienced managed hosting provider since 2001. True 24x7 Support & Server Management

  17. #17
    Join Date
    Oct 2007
    Location
    CA,USA
    Posts
    320
    I think it's a bad idea.

    There is to many security issues and exploits to get root privileges easily.

  18. #18
    Quote Originally Posted by serverorigin View Post
    right... Until a buffer overflow exploit... kind of like the 3 that came out this month for linux, drops you to a normal/root shell
    I don't see jail shell to be anymore of a risk than PHP. That is unless you limit a big hand full of functions. On most servers you can do basically everything you can do in jail shell through PHP. As long as you have your server secured; mainly the kernel it should be fine to verified clients.
    Eleven2 Web Hosting - World-Wide Hosting, Done Right!

  19. #19
    Join Date
    Apr 2002
    Location
    Auckland - New Zealand
    Posts
    1,572
    It's not as though you can't do anything with cron jobs, scripts and what have you anyways, if you wanted to exploit something.

    Give shells to people that you know or pay for it maybe, but I wouldn't enable unless people ask. No need to be over paranoid, if you are, then maybe giving out shell access isn't for you.

  20. #20
    Join Date
    Jun 2006
    Location
    NYC
    Posts
    1,446
    Quote Originally Posted by SharkSpace View Post
    I don't see jail shell to be anymore of a risk than PHP. That is unless you limit a big hand full of functions. On most servers you can do basically everything you can do in jail shell through PHP. As long as you have your server secured; mainly the kernel it should be fine to verified clients.
    Undoubtedly you have never seen what can happen at a shell. Certainly, you can cause havoc via cron but as long as permissions are right and userlimits are configured, then that's a non-issue.

    Scripts - if the PHP functions are hardened, CGI is limited and Apache is threaded, then again - limited possibility of attack.

    Drop in a shell and access to a compiler and any 0-day hack and they'll be allowed full root. Not only to your server but your user's data. Most scripts/cron attacks are either local DoS attacks or local to the account as long as the system is hardened. Shell based attacks can range from bots, disk fillers, injections, memory & packet sniffers, jail breakers, cpu hogs, rootkits, cookie parsers, sendmail exploits, passwd/group file tracking for use with brute force attacks, etc. The list goes on and on. You essentially remove that web protection and allow direct local disk access to files/services.

    It's EXTREMELY simple with known/0-day exploits for someone to do something as easy as a wget filename and download a pre-built binary. Type ./run and drop to root access.
    Last edited by FiberPeer; 08-22-2009 at 05:18 AM.
    FiberPeer.Com | | REAL DDoS Protection | Cloud Hosting | VPS | Dedicated Servers | High Bandwidth Hosting | 1Gbps-10Gbps Unmetered
    FiberPeer DDoS Mitigation | ethProxy Upgraded! | 14-Years Experience | Emergency 24/7 Support
    Visit us @ www.fiberpeer.com

  21. #21
    Join Date
    Nov 2004
    Location
    India
    Posts
    91

    Thumbs up

    Jailshell by default --> A big No
    Jailshell for selected users, who request it at an additional cost --> Can be considered.

    My recommendation --> Do not market jail shell on your website. Give it only to people who really need it. If possible, enforce key based authentication.
    "If you have knowledge, let others light their candles in it. "

  22. #22
    Join Date
    Apr 2002
    Location
    Auckland - New Zealand
    Posts
    1,572
    Of course you can run bash scripts or perl scripts from cron or directly within a control panel for example, it's no different really. If someone wants to cause havoc, they will and limiting php functionality, adding mod_security rules and a firewall, is not going to save you. That doesn't mean it isn't worthwhile though. The only thing that prevents being hacked, is solving the vulnerability itself, or making it completely inaccessable. With a 0-day vulnerability, you just hope that you aren't among the first to be hit with it.

  23. #23
    Join Date
    Nov 2004
    Location
    India
    Posts
    91

    Thumbs up

    Quote Originally Posted by StevenG View Post
    Of course you can run bash scripts or perl scripts from cron or directly within a control panel for example, it's no different really. If someone wants to cause havoc, they will and limiting php functionality, adding mod_security rules and a firewall, is not going to save you. That doesn't mean it isn't worthwhile though. The only thing that prevents being hacked, is solving the vulnerability itself, or making it completely inaccessable. With a 0-day vulnerability, you just hope that you aren't among the first to be hit with it.
    There are 2 main procedures in security.

    Completely patching the vulnerability is one step.
    Make it harder or not easy to hack, even when a vulnerability arises is another step.

    There are a good % of lazy script kiddies who would rather try a hosting with shell access than try to run the script through a cron. The amount of brute force attempts can be reduced by a huge chunk, if you change the ssh default port. This is not because hackers don't know how to find the ssh port. But they would rather prefer an easier route. There are 100s of other servers with ssh running on default port. So, why waste their time on scanning the port number for each server.
    "If you have knowledge, let others light their candles in it. "

  24. #24
    Join Date
    Dec 2006
    Posts
    477
    Drop in a shell and access to a compiler and any 0-day hack and they'll be allowed full root. N
    Why access to a compiler? What's to stop users uploading binaries themselves?

  25. #25
    Join Date
    Aug 2006
    Location
    Ashburn VA, San Diego CA
    Posts
    4,571
    Just make sure you've got a good brute force detection installed like CSF/BFD before you give shell access. The worst problem with giving out shell is not your own customer, it is hackers who guess their password.
    Fast Serv Networks, LLC | AS29889 | Fully Managed Cloud, Streaming, Dedicated Servers, Colo by-the-U
    Since 2003 - Ashburn VA + San Diego CA Datacenters

  26. #26
    Quote Originally Posted by serverorigin View Post
    Undoubtedly you have never seen what can happen at a shell. Certainly, you can cause havoc via cron but as long as permissions are right and userlimits are configured, then that's a non-issue.
    An experienced hacker does not need any type of shell access or even a script kiddie. They would actual prefer using PHP/cgi scripts so they could easily setup a bot and attack thousands of servers at once. Normally they attack popular scripts such as wordpress or phpbb that are outdated. You can easily generate a list of sites using a certain script, but there is no way to generate a list of sites using jail shell. As I stated several times already jail shell is just as secure as php and also cron and cgi. Your only argument is a 0 day exploit. Jail shell or not there is no way to protect yourself until a patch is released. The recent 0 day was referenced, the main form of attack on that exploit has been through php.

    If you verify your users correctly at order time and they request jail shell, there should be no reason why you can not offer it.
    Eleven2 Web Hosting - World-Wide Hosting, Done Right!

  27. #27
    Join Date
    Jun 2004
    Location
    New York, NY
    Posts
    372
    *sigh*

    Please stop talking about 0day this 0day that. Everything could be exploited, people who are doing security for living get exploited.

    I'm also not sure why focus of this is getting 'rooted', most of the time abuse comes from using malicious scripts (scanners, data generators, d/dos, bots).
    a
    It is a /little tiny bit/ harder to run those scripts without shell access but very very possible. Shell just offers a more convenient way of running them.

    Shell will not allow you to get 'rooted' by customer that has access to those tools and was on your server using your service for web hosting.

    Quote Originally Posted by BarackObama View Post
    Also, disable GCC for the users and you should be pretty safe.
    Makes no difference.

    Quote Originally Posted by Layershift Damien View Post
    There is no concrete good reason for a shared/reseller customer to need SSH access. However, if they actually do have some genuine reason then they'll be best suited to a VPS of one nature or another.

    Advice to consumers: be concerned if your shared/reseller host offers SSH access - it could lead to security/reliability issues affecting your service!
    There are plenty of good reasons people would want shell access; among them are serious developers, people who manage data, etc.

    No need to make pointless blanket statements 'to avoid providers who offer shell access'. The more correct way would be 'to avoid providers who are clueless'.

    For every host that offers shell access there are millions of web hosting providers with un-patched kernels/daemons/weak passwords/lack of screenings/etc.

    Quote Originally Posted by serverorigin View Post
    Undoubtedly you have never seen what can happen at a shell. Certainly, you can cause havoc via cron but as long as permissions are right and userlimits are configured, then that's a non-issue.

    Scripts - if the PHP functions are hardened, CGI is limited and Apache is threaded, then again - limited possibility of attack.

    Drop in a shell and access to a compiler and any 0-day hack and they'll be allowed full root. Not only to your server but your user's data. Most scripts/cron attacks are either local DoS attacks or local to the account as long as the system is hardened. Shell based attacks can range from bots, disk fillers, injections, memory & packet sniffers, jail breakers, cpu hogs, rootkits, cookie parsers, sendmail exploits, passwd/group file tracking for use with brute force attacks, etc. The list goes on and on. You essentially remove that web protection and allow direct local disk access to files/services.

    It's EXTREMELY simple with known/0-day exploits for someone to do something as easy as a wget filename and download a pre-built binary. Type ./run and drop to root access.
    Wait... you talking about 0day scene and you think anyone in 0day scene will be thrown off by not having shell access on server he/she has an account on? I don't know if you are serious, please just stop.

    But, you do get points for pointless fluffer.

    Quote Originally Posted by FastServ View Post
    Just make sure you've got a good brute force detection installed like CSF/BFD before you give shell access. The worst problem with giving out shell is not your own customer, it is hackers who guess their password.
    CSF/BFD is meh. Good point on passwords; but that's the case for non-shell accounts as well.
    All My Data From small shared web hosting accounts to powerful dedicated servers.
    Now offering Affordable UNIX shells and IRCd hosting!

  28. #28
    Join Date
    Jun 2004
    Location
    New York, NY
    Posts
    372
    Quote Originally Posted by SharkSpace View Post
    If you verify your users correctly at order time and they request jail shell, there should be no reason why you can not offer it.
    Just wanted to echo this.
    All My Data From small shared web hosting accounts to powerful dedicated servers.
    Now offering Affordable UNIX shells and IRCd hosting!

  29. #29
    Join Date
    Jun 2006
    Location
    NYC
    Posts
    1,446
    Quote Originally Posted by Stacie View Post
    *sigh*

    Please stop talking about 0day this 0day that. Everything could be exploited, people who are doing security for living get exploited.

    I'm also not sure why focus of this is getting 'rooted', most of the time abuse comes from using malicious scripts (scanners, data generators, d/dos, bots).
    a
    It is a /little tiny bit/ harder to run those scripts without shell access but very very possible. Shell just offers a more convenient way of running them.

    Shell will not allow you to get 'rooted' by customer that has access to those tools and was on your server using your service for web hosting.



    Makes no difference.



    There are plenty of good reasons people would want shell access; among them are serious developers, people who manage data, etc.

    No need to make pointless blanket statements 'to avoid providers who offer shell access'. The more correct way would be 'to avoid providers who are clueless'.

    For every host that offers shell access there are millions of web hosting providers with un-patched kernels/daemons/weak passwords/lack of screenings/etc.



    Wait... you talking about 0day scene and you think anyone in 0day scene will be thrown off by not having shell access on server he/she has an account on? I don't know if you are serious, please just stop.

    But, you do get points for pointless fluffer.



    CSF/BFD is meh. Good point on passwords; but that's the case for non-shell accounts as well.
    Well I'd say that you're definitely in a different situation than the rest of us. Your likely downfall may not be just the victim of a hacked system but simply your arrogance.
    FiberPeer.Com | | REAL DDoS Protection | Cloud Hosting | VPS | Dedicated Servers | High Bandwidth Hosting | 1Gbps-10Gbps Unmetered
    FiberPeer DDoS Mitigation | ethProxy Upgraded! | 14-Years Experience | Emergency 24/7 Support
    Visit us @ www.fiberpeer.com

  30. #30
    Join Date
    Jun 2004
    Location
    New York, NY
    Posts
    372
    Quote Originally Posted by serverorigin View Post
    Well I'd say that you're definitely in a different situation than the rest of us. Your likely downfall may not be just the victim of a hacked system but simply your arrogance.
    The real question is, is there a 0day exploit for that?

    Unsubscribed.
    All My Data From small shared web hosting accounts to powerful dedicated servers.
    Now offering Affordable UNIX shells and IRCd hosting!

Similar Threads

  1. Jailed shell on a VPS
    By ramdak5000 in forum Hosting Security and Technology
    Replies: 9
    Last Post: 04-02-2007, 12:58 PM
  2. Jailed Shell and Normal Shell
    By webhostbeginner in forum Dedicated Server
    Replies: 5
    Last Post: 06-17-2005, 01:08 PM
  3. jailed shell
    By desdelleida in forum Web Hosting
    Replies: 1
    Last Post: 12-31-2004, 10:57 AM
  4. Jailed Shell
    By gearworx in forum Hosting Security and Technology
    Replies: 3
    Last Post: 09-21-2004, 01:13 PM
  5. What is The Different between Normal Shell & Jailed Shell
    By forumtalk in forum Hosting Security and Technology
    Replies: 4
    Last Post: 09-26-2003, 04:08 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •