Displaying 3 results from an estimated 3 matches for "mm_audit_end_command".
2023 Jul 05
1
Subsystem sftp invoked even though forced command created
...o_exec().
https://github.com/openssh/openssh-portable/blob/V_7_4_P1/session.c#L1938-L1944
Further evidence that this is the case is the audit calls that log the
command being executed:
debug3: mm_audit_run_command entering command
/opt/app/workload/secgov/opt/sact-central/bin/receive.ksh
debug3: mm_audit_end_command entering command
/opt/app/workload/secgov/opt/sact-central/bin/receive.ksh
So the command appears to have been correctly overridden and nothing in
the debug logs explains the behaviour you're reporting.
Some possibilities:
1. the receive.ksh script is faulty in some way that causes it to inv...
2023 Jul 03
1
Subsystem sftp invoked even though forced command created
On 30.06.23 17:56, MCMANUS, MICHAEL P wrote:
> The actual command is similar to the following (parameters inserted to protect the source):
> (print ${FQDN} ; print ${Environment} ; cat ${OutFileXML}) | \
> ssh -Ti ${EmbeddedPrivateKey} \
> -o HostKeyAlias="${Alias}" \
> -o
2023 Jun 30
1
Subsystem sftp invoked even though forced command created
On 30/06/2023 09:56, Damien Miller wrote:
> It's very hard to figure out what is happening here without a debug log.
>
> You can get one by stopping the listening sshd and running it manually
> in debug mode, e.g. "/usr/sbin/sshd -ddd"
Or starting one in debug mode on a different port, e.g. "-p99 -ddd"