PowerStore: Understanding shell limitations due rbash and other security implementations

Possible errors observed as a result of these measures:

• rbash: cd: restricted (when trying to navigate through the directories)
• rbash: xxxx: restricted: cannot redirect output (when trying to redirect outputs to a file with ">")
• rbash: xxxx: command not found (when trying to run commands not in the approved allow list)
• rbash: ./example_script: restricted: cannot specify `/' in command names (when trying to run scripts)
• Cannot initialize SFTP protocol. Is the host running an SFTP server? (when trying to setup file transfer tools like WinSCP)
• Command 'cd "xxxx"' failed with return code 1 and error message. -rbash: line 47: cd: restricted (when trying to change directories with WinSCP)

rbash implementation means is that the shell behavior is changed by disabling some actions and features, including:

• Changing directories with the cd builtin.
• Setting or unsetting the values of the SHELL, PATH, ENV, or BASH_ENV variables.
• Specifying command names containing slashes.
• Specifying a filename containing a slash as an argument to the . builtin command.
• Specifying a filename containing a slash as an argument to the -p option to the hash builtin command.
• Importing function definitions from the shell environment at startup.
• Parsing the value of SHELLOPTS from the shell environment at startup.
• Redirecting output using the ‘>’, ‘>|’, ‘<>’, ‘>&’, ‘&>’, and ‘>>’ redirection operators.
• Using the exec builtin to replace the shell with another command.
• Adding or deleting builtin commands with the -f and -d options to the enable builtin.
• Using the enable builtin command to enable disabled shell builtins.
• Specifying the -p option to the command builtin.
• Turning off restricted mode with ‘set +r’ or ‘set +o restricted’.

See here for more details:
https://www.gnu.org/software/bash/manual/html_node/The-Restricted-Shell.html 

A few alternatives are presented here to make navigation and interaction with the system easier despite the limitations that are described above.

File Transfers 

Use SCP instead of SFTP or FTP protocol when setting up file transfer tools such as WinSCP.   

Remember:
Users are not able to change directories (cd not allowed), so everything to be downloaded from the node or appliance has to be copied first to /home/service/user.
The only exception to this would be the normal Support Materials. Links are automatically placed in the home directory for each available set of Support Materials to facilitate downloads.

If you want to download files directly from the directory they are on, you have to find the full path first from the PowerStore shell, then you can use tools such as pscp (from windows cli) or scp (from linux).
Windows pscp example:

Syntax:

Usage: pscp [options] [user@]host:source target pscp [options] source [source...] [user@]host:target

Note: in some new versions of Windows 10, you may have to specify the port (-P 22).

Download example:

pscp -scp -P 22 service@<appliance or node IP>:/path/to/file/to/download C:\Local\dowwnload-save\location pscp -scp service@xx.xx.xx.xx:/cyc_var/cyc_service/data_collection/xxxxxxxx/powerstore_xxxxxxxx_2020-05-06_00-00-00_service-data.tgz C:\LOGS service@xx.xx.xx.xx's password: powerstore_xxxxxxxxx | 10944 kB | x.x kB/s | ETA: 00:00:00 | 100%

Upload example:

pscp -scp -P 22 C:\Logs\somefile.txt service@xx.xx.xx.xx:/home/service/user service@xx.xx.xx.xx's password: somefile.txt           | 211 kB | 212.0 kB/s | ETA: 00:00:00 | 100%

 

Navigation