<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
I had a similar idea to this once: see
<a class="moz-txt-link-freetext" href="http://www.hswn.dk/hobbiton/2006/09/msg00537.html">http://www.hswn.dk/hobbiton/2006/09/msg00537.html</a><br>
It could be handy to be able to specify running an external command,
the interval to run it at, and a tag name for it in client-data (and/or
perhaps option for the output to be added to a specified column on the
Hobbit display).<br>
<br>
As for executing remote commands being a security risk, other
monitoring programs like Nagios do this (over ssh), and as pointed out
it is already possible via using backticks in the log directive.
Honestly if someone roots your hobbit server they wouldn't need much
help getting into everything else. You should be running the hobbit
clients as a non-privledged user, and could even put them in a chroot
jail if you want to sleep better at night :)<br>
<br>
-Charles<br>
<br>
Haertig, David F (Dave) wrote:
<blockquote
cite="mid:9836EA7D7FDAE34099AED87A2D9C3A8D257BB0@306181ANEX2.global.avaya.com"
type="cite">
<pre wrap="">It doesn't matter to me if you add this new feature or not. It might be
nice, but it's not a deal-breaker.
However, the ability to run arbitrary commands on the client as directed
from the server end is already there. Via the backticks in the log
directive. A new "addon" directive might make this easier to access an
dgive it more visibility, but the ability to do remote damage already
exists.
-----Original Message-----
From: Henrik Stoerner [<a class="moz-txt-link-freetext" href="mailto:henrik@hswn.dk">mailto:henrik@hswn.dk</a>]
Sent: Monday, June 11, 2007 2:48 PM
To: <a class="moz-txt-link-abbreviated" href="mailto:hobbit@hswn.dk">hobbit@hswn.dk</a>
Subject: Re: [hobbit] How to run an arbitary script on the client end?
On Mon, Jun 11, 2007 at 04:22:08PM -0400, Kern, Thomas wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Would this new ADDON feature be configured at the server side or on
each client?
</pre>
</blockquote>
<pre wrap=""><!---->
Server-side, in the client-local.cfg file.
</pre>
<blockquote type="cite">
<pre wrap="">I have a gut reaction against some other server being able to
arbitrarily execute commands on my systems
</pre>
</blockquote>
<pre wrap=""><!---->
I agree. When I wrote the client, I actually did think about doing
something like this, but decided against it for that very reason.
And if you're the only one who wants it, then I'll probably NOT
implement it.
</pre>
<blockquote type="cite">
<pre wrap="">but I know who runs our
hobbit server. I am also against having to modify each hobbit client
that I run if I come up with a new nifty ADDON. I have not looked into
</pre>
</blockquote>
<pre wrap=""><!---->
</pre>
<blockquote type="cite">
<pre wrap="">the update/upgrade mechanism since I know the hobbit-server admin, but
</pre>
</blockquote>
<pre wrap=""><!---->
</pre>
<blockquote type="cite">
<pre wrap="">is there some authentication of the updates/upgrades/new_ADDONs that
can be done so that they only come from a trusted source?
</pre>
</blockquote>
<pre wrap=""><!---->
Updates are only downloaded from the Hobbit server. But apart from that,
there's no authentication of the new client code.
Regards,
Henrik
To unsubscribe from the hobbit list, send an e-mail to
<a class="moz-txt-link-abbreviated" href="mailto:hobbit-unsubscribe@hswn.dk">hobbit-unsubscribe@hswn.dk</a>
To unsubscribe from the hobbit list, send an e-mail to
<a class="moz-txt-link-abbreviated" href="mailto:hobbit-unsubscribe@hswn.dk">hobbit-unsubscribe@hswn.dk</a>
</pre>
</blockquote>
<br>
</body>
</html>