Page Comparison

Setup of the SUDO command in Version 4

Background

iQSonar v3 used a “Shell on Shell” approach to SSH scanning. This introduced complications when it came to the complexities and variances introduced by different versions of shells and terminals on different distributions of linux and unix operating systems. The approach effectively emulated what an end user would do on a target machine. The problems came when messages like “You’ve got mail” were printed to the terminal. While a human could simply ignore the text, it introduced many difficulties for iQSonar and often contaminated the results or caused scans to fail.

In iQSonar v4 the decision was made to use ssh channels as opposed to a shell on shell approach. This removed any complications introduced by shells and terminals and allowed the execution and interpretation of commands and raw results independently. While this approach is faster and more accurate, it does however bypass the loading of any shell so any shell profile setup (such as aliases) will be bypassed. This meant that the v3 approach to sudo (creating Aliases) was no longer effective as the alias information was only loaded once the shell was loaded.

In v4, iQSonar has taken control of sudo execution. As opposed to relying on complex target environment configuration to dictate where and when sudo is run, iQSonar v4 allows for central control of sudo execution. Once SUDO is enabled in iQSonar, when scanning a target, iQSonar first checks to see if the command is available to be run with sudo, if the answer is yes, it then executes the command with sudo, if not it executes it directly. There are specific configurations that need to be enabled on the target device with regard to sudo, but provided these configurations are met, iQSonar will scan any target environment using sudo where required

Step-by-step guide

1. From the UI navigate to Locations > Connections > SHH
2. Change commandprefixcode to SUDO
3. Change usecommandprefix to True

The actual command that is being run is as follow:

{Code}{set the path};if sudo -l {command}>/dev/null; then sudo {command}; else {command};fi

{Code}

This difference might be important because the The precise behaviour might be dependent on the user’s standard shell. ‘if’ is a shell command that can have slightly different behaviours behaviors on different shells.

… it is a very simple use of ‘if’, so it probably won’t be a problem … (probably).

Image Removed

...

Image Added

Related articles