check_by_ssh: Prevent users from using several SSH options which run local commands.

Author: Sebastian Wolf

NEWS

@@ -1,10 +1,11 @@
 This file documents the major additions and syntax changes between releases.
 
-2.4.5 2023-05-15
+2.4.5 2023-05-31
 	FIXES
 	check_dns: Fix buffer overflow on Ubuntu 22.04 (#699)
 	check_sensors: Use grep instead of deprecated egrep (#697)
 	check_tcp: Add --sni as an alias to -N (#701)
+	check_by_ssh: Prevent users from using ProxyCommand/LocalCommand/PermitLocalCommand (./configure --with-unrestricted-ssh-options=yes to re-enable)
 	build: fix bug when using VPATH builds (#700)
 
 2.4.4 2023-04-14

configure.ac

@@ -418,6 +418,16 @@ then
 		[path and arguments for invoking 'who'])
 fi
 
+AC_ARG_WITH(unrestricted_ssh_options,
+	[AS_HELP_STRING([--with-unrestricted-ssh-options],
+		[allow any SSH options to be used with check_by_ssh])],
+	[],
+	[unrestricted_ssh_options=no])
+
+if test "x$with_unrestricted_ssh_options" = xyes ; then
+	AC_DEFINE(HAVE_UNRESTRICTED_SSH_OPTIONS,[1],[Allow SSH to use options that run local commands.])
+fi
+
 AC_ARG_WITH([ipv6],
 	[AS_HELP_STRING([--with-ipv6], [support IPv6 @<:@default=check@:>@])],
 	[], [with_ipv6=check])

plugins/check_by_ssh.c

@@ -27,7 +27,7 @@
 *****************************************************************************/
 
 const char *progname = "check_by_ssh";
-const char *copyright = "2000-2014";
+const char *copyright = "2000-";
 const char *email = "devel@nagios-plugins.org";
 
 #include "common.h"
@@ -304,6 +304,16 @@ process_arguments (int argc, char **argv)
 				skip_stderr = atoi (optarg);
 			break;
 		case 'o':									/* Extra options for the ssh command */
+
+			/* Don't allow the user to run commands local to the nagios server, unless they decide otherwise at compile time. */
+#ifndef HAVE_UNRESTRICTED_SSH_OPTIONS
+			if (   strcasestr(optarg, "ProxyCommand") != NULL
+				|| strcasestr(optarg, "PermitLocalCommand") != NULL
+				|| strcasestr(optarg, "LocalCommand") != NULL) {
+				break;
+			}
+#endif
+
 			comm_append("-o");
 			comm_append(optarg);
 			break;