Defining Prompt-Based Command Policies for SSH Connections
Prompt-based identification on the Kron PAM SSH Proxy allows or blocks users from executing commands on the device connected to. This ensures that unauthorized users are prevented from executing any commands.
For example, you can define a rule that allows the root user to establish an SSH connection to a device but prevents other users from executing the ssh command.
First, we need to explain what we mean by the “prompt.” The prompt is the part of the screen that appears when you connect to a device and waits for you to enter a command. After connecting to the device, it displays your username, the server name, and the current directory.
For example:
[John@product-pam: ~]#
Read this prompt as follows:
· John :Username.
· product-pam:Server name.
· ~ :Current directory
· # :Session type
A # at the end indicates a root session, while a $ at the end indicates a regular user session.
A prompt-based policy reads the content of this prompt to determine the environment of the session. To define an environment, you write a pattern that matches the prompt of that environment. For example, a prompt that contains root@ identifies a root session.
How to Write a Rule
A rule, called a Policy Key, consists of two parts: the prompt part and the command part.
User can define in the following format: <prompt> PROMPT_PATTERN </prompt> COMMAND_PATTERN
· <prompt> ...</prompt> between these tags, user should write the prompt pattern that defines the environment where the rule applies.
· </prompt> after this tag, user should write the command pattern that you want to target
The closing tag must include a slash (). If you write both tags as , the rule does not work.
Example: Allow the root user to run ssh, and block all other users.
Define the following rule as a Black Key, that is, a rule that blocks the matching command:
<prompt>(?!.*root@).*</prompt>ssh.*
Read the rule part by part:
· (?!.*root@).* — the prompt part. It matches prompts that do not contain root@, that is, non-root (normal) user sessions. The leading (?!...) expression means “match what does not contain this.”
· ssh.* — the command part. It targets every command that starts with ssh. With this rule defined, a normal user who tries to run ssh is blocked, while the root user is not caught by the rule and runs the command freely.
Session | Example Prompt | Result When Running ssh |
|---|---|---|
Root | [root@product-pam: ~]# | Allowed |
normalUser | [John@product-pam: ~]# | Blocked |
How to Define Prompt Based Policy in Kron PAM
To define the Prompt Based Policy in Kron PAM, follow these steps:
1. Navigate to Policy > Policy Keys
2. Click the Add button, select Black Key as the Policy Key Type, then click Next
3. On the screen that opens, add the prompt rule to the Black Key Regex the following format:
<prompt>PROMPT_PATTERN</prompt>COMMAND_PATTERN
4. Click the Save button to complete the operation
5. Add the Relevant Policy Key Value to the Policy Group that you want to define or update.
6. In the Realm definition, specify which user group and device group the command-based restriction applies to.
7. An SSH connection is established to the user and device group defined in the realm. The ssh command is executed using the John user, as defined in the example above. It is observed that the operation does not occur when this username is used to execute the command.
8. If you switch to the root user and run the ssh command again, you will see that the operation is performed for that user.
