Merge pull request #560 from phlb/feature/fix-ssh-spawn

Use exec for direct ssh connect instead of system
LibrIT · May 11, 2021 · 8f4766c · 8f4766c
2 parents f9c7a8c + 9500f68
commit 8f4766c
Showing 1 changed file with 32 additions and 14 deletions.
diff --git a/passhport/connections_utils/ssh.py b/passhport/connections_utils/ssh.py
@@ -6,7 +6,7 @@
 from __future__ import absolute_import
 from __future__ import unicode_literals
 
-import os, requests
+import os, requests, shlex, sys
 
 def connect(target, filelog, login, port, sshoptions, pid, url_passhport, 
             cert, ssh_script, username, originalcmd):
@@ -19,18 +19,36 @@ def connect(target, filelog, login, port, sshoptions, pid, url_passhport,
                  url_passhport, cert, username, sshoptions)
 
     else:
-        f = open(filelog, "w")
-        f.write("DIRECT COMMAND --- " + originalcmd + "\n")
-        f.close()
-        os.system('ssh -p ' + str(port) + " " + login + '@' + target + \
-                  ' ' + sshoptions + " '" + originalcmd + "'" )
-
-    url = url_passhport + "connection/ssh/endsession/" + str(pid)
-    try:
-        if cert != "/dev/null": 
-            r = requests.get(url, verify=cert)
+        ssh_args = [
+                '-p' + str(port),
+                login + '@' + target,
+            ]
+        ssh_args += shlex.split(sshoptions)
+        ssh_args += [ originalcmd ]
+
+        newpid = os.fork()
+        if newpid == 0:
+            os.execv('/usr/bin/ssh', ssh_args)
         else:
-            r = requests.get(url)
+            # Close stdin & stdout to not interfere with the ssh command
+            sys.stdin.close()
+            sys.stdout.close()
+
+            # Log stuff
+            f = open(filelog, "w")
+            f.write("DIRECT COMMAND --- " + originalcmd + "\n")
+            f.close()
+
+            # Wait the end of the child process execution
+            os.waitpid(newpid, 0)
+
+            # Log stuff
+            url = url_passhport + "connection/ssh/endsession/" + str(pid)
+            try:
+                if cert != "/dev/null": 
+                    r = requests.get(url, verify=cert)
+                else:
+                    r = requests.get(url)
 
-    except requests.RequestException as e:
-        print("ERROR: " + str(e.message))
+            except requests.RequestException as e:
+                print("ERROR: " + str(e.message), file=sys.stderr)