[Home]

Summary:ASTERISK-00391: [patch] Implement system command through the manager interface
Reporter:paulohm2 (paulohm2)Labels:
Date Opened:2003-10-17 11:13:40Date Closed:2011-06-07 14:04:46
Priority:MajorRegression?No
Status:Closed/CompleteComponents:Core/General
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:( 0) systemcli2.diff
Description:Implements the system command through the manager interface. For security issued, a file named system.conf must be created at /etc/asterisk, with the allowed commands, as below:

[allowed_commands]
command=ls
command=df
command=ps
Comments:By: James Golovich (jamesgolovich) 2003-10-19 19:14:23

Is this really necessary to be included in asterisk?  Perhaps using ssh would be better suited for this.
By: John Todd (jtodd) 2003-10-19 19:46:49

I think it's not a bad idea, actually.  While there may be security concerns, I would suggest that giving a single interface to controlling an Asterisk "system" is a decent idea ("system" is different than "process", meaning that the system includes the Linux box that supports Asterisk.)

The command list is optional, and should have no entries as a default.  Let people shoot themselves in the head if they have poor security controls, but I think that allowing system commands via the manager would be useful to more robust asterisk manager graphical front ends (whenever they are programmed...)  Not everything that is done with Asterisk is done via a command that can be executed within Asterisk, and having to write the manager app to also launch SSH seems to be somewhat redundant if an authenticated socket connection is already open.
By: jrollyson (jrollyson) 2004-01-11 00:00:16.000-0600

I don't see the point, other remote execution systems have better developed security systems. I see this as an accident (or worse) waiting to happen.
By: ww (ww) 2004-01-11 18:18:22.000-0600

this implements a remote root shell through the manager interface. very dangerous.
i agree with jrollyson -- better to use ssh or kerberos rsh
By: zoa (zoa) 2004-01-11 18:21:53.000-0600

maybe as an option ? if there is a limit on the commands you can execute this might be usefull for some people. (although i agree that leaving this on by default is a big security risk)
By: Brian West (bkw918) 2004-01-11 18:25:25.000-0600

We love new ideas but the idea of this does bring about some major issues.  Maybe if we can have a secure method of execution but then we might as well use ssh.  keep up the good work.

Thanks,
Brian