4 ms·
Because bash for some goddamn reason loads the bashrc for interactive shells AND when started by sshd, regardless of whether the shell is interactive or an tty
by blueflow 2y ago
Because bash for some goddamn reason loads the bashrc for interactive shells AND when started by sshd, regardless of whether the shell is interactive or an tty is present. Bash (and only bash) literally has a special case for sshd to enable this kind of exploit.
As a result of this, git and rsync wont work at all if the bashrc on the remote machine writes any data to stdout. Like setting a window title.
To work around that, every bashrc on this earth needs a case switch to return early to avoid this specific bug.
- yjftsjthsd-h 2y agoWait, ssh doesn't let you specify the remote command without running it through the user's shell? That seems like a deficiency too IMHO.
- nurettin 2y agoIt is simpler to export paths locally, so the remote doesn't have to know your file/folder structure.
- yjftsjthsd-h 2y agoSure, it's convenient to have PATH, but why not have an optional way to say "hey, ssh, run /usr/bin/rsync on the remote with the following arguments, directly and without a shell please"? Equivalent to a Dockerfile containing cmd foo vs cmd ["/bin/foo"] (IIRC, at least - been a minute since I needed to do this.)
- pabs3 2y agoSee the OpenSSH bug above.
- kpcyrd 2y agoIt's a limitation in the ssh protocol. I wish they would fix it, but I'm not holding my breath. Trying to do anything about it would be a compatibility nightmare. If you need to pass data through ssh you're better off doing it through stdin.
- pabs3 2y agoSuggestion for adding it is here, basically they were skeptical there are use-cases for it: https://bugzilla.mindrot.org/show_bug.cgi?id=2283 https://bugzilla.mindrot.org/show_bug.cgi?id=2283
- blueflow 2y agoCommand strings must be expanded to an argument vector by some kind of shell. SSH itself does not allow to execute a program by argument vector like execv.
- deleted 2y ago[deleted]
- pjc50 2y agoThis is sort of a feature that allows for restricted shells such as menu systems.
- yjftsjthsd-h 2y agoIt seems like ForcedCommand should work regardless?