I approached this a little different, after thinking about it some more....so, I kind of built my own modified version of the rooter script. I love rooter, but I like for my NAS to be more "secured".
So I did the following...
Added Admin to the telnet.users file
Added Admin to the sudoers file
Now the catch is that the crontab script /usr/sbin/chkhttpd (which is in the read-only file system) has a line that replaces/recreates the /etc/telnet.user file
Code:
open(OUT,">/etc/telnet.user");
print OUT "root\n";
print OUT "engmode\n";
close(OUT);
To solve that, i used chattr +i on the /etc/telnet.user file, which means the file is immuatable, and even root cant change it. Yes its going to cause part of the chkhttpd script to fail, but nothing that will break the system
The telnet.user file and sudoer file survive reboots, but the "immutable" flag does not remain. So the script sets it every time. And now I can login to the NAS, securely, with the admin account.
root stays locked, and if i need to run something as root, there is always sudo.
Now without further delay, my "secure admin / root" script.
Code:
#!/usr/bin/perl
#$app_path = $ENV{'APP_PATH'};
#print "APP_PATH = $app_path\n";
#$action = $ARGV[0];
print "Rooter Rooting...\n";
#system("/VOLUME1/PLUGINAPP/Rooter/bin/busybox passwd -d root");
#print "Rooted...?";
system("/bin/echo 'admin ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers");
system("/bin/echo 'admin' >> /etc/telnet.user");
system("/VOLUME1/PLUGINAPP/Rooter/bin/busybox chattr +i /etc/sudoers");
system("/VOLUME1/PLUGINAPP/Rooter/bin/busybox chattr +i /etc/telnet.user");
I'm happy with this. It works for me. Maybe i'll work on creating another script that will follow along the lines of my enhancement request.
Rooter Plugin Suggestion / Enhancement
).
Reply With Quote
