Account switching tool based on ssh key non-root account

Abstract

The invention discloses an account number switching tool based on an ssh secret key non-root account number. The account number switching tool comprises the following steps: receiving and verifying a switching target account number parameter input by a user through a parameter input module; judging whether the input name is a Root account number or not, and if the input name is the Root account number, directly exiting a program; judging whether a user of the current execution tool is a specific operation and maintenance support engineer account or not through a user identity verification module, and if not, exiting the program; calling a key extraction tool gegidrsa with an SUID permission through a key extraction module, and obtaining an SSH private key file of the input name account through a Root permission; and switching to a target account based on the SSH private key file by calling a system tool ssh, and entering a computing environment of the target account. According to the account switching tool based on the ssh secret key and the non-Root account, the SSH secret key and the non-Root account switching operation are combined, so that a safe, efficient and auditable user identity switching mode is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of servers, and in particular to an account switching tool based on an SSH key non-root account. Background Art

[0002] In the current server operation and management process, multiple operation and maintenance engineers are often required to perform specific tasks with different non-root accounts. Traditional user switching methods usually rely on su or sudo commands, but these methods directly grant users root permissions or use root identities to switch to other accounts, which can easily lead to abuse of permissions or security vulnerabilities. Moreover, in a multi-user operation and maintenance environment, frequently manually entering passwords or calling complex commands will significantly reduce work efficiency. At the same time, traditional user switching methods make it difficult to fully record detailed information on switching operations and cannot meet audit and traceability requirements.

[0003] In order to solve the above problems, the present invention proposes a non-root account switching tool based on SSH key, which realizes a safe, efficient and auditable user identity switching method by combining SSH key with non-root account switching operation. The tool is suitable for multi-user server environment, especially for scenarios where root account operations are restricted or strict permission control is required. Summary of the invention

[0004] The purpose of the present invention is to provide an account switching tool based on ssh key non-root account to solve the currently commonly used problems raised by the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solution: an account switching tool based on ssh key non-root account, comprising the following steps:

[0006] Step 1: Receive and verify the target account parameter inputname input by the user through the parameter input module;

[0007] Step 2, determine whether the inputname is a root account, if so, exit the program directly;

[0008] Step 3: determine whether the user currently executing the tool is a specific operation and maintenance support engineer account through the user identity authentication module, and if not, exit the program;

[0009] Step 4: Call the key extraction tool getidrsa with SUID permission through the key extraction module to obtain the SSH private key file of the inputname account with root permission;

[0010] Step 5: Switch to the target account based on the SSH private key file by calling the system tool ssh, and enter the computing environment of the target account;

[0011] Step 6: Record the switching log, which includes input parameters, switching target account, initiating user, switching time and switching result;

[0012] Step 7: After the switch is completed, the temporarily generated SSH private key file is automatically cleaned up to ensure system security;

[0013] Among them, the step 5 is specifically: returning the extracted SSH private key to the switching tool core component chuser, and completing the switching operation from the current user to the target account using the SSH protocol through the chuser tool.

[0014] Preferably, the key extraction tool getidrsa has permissions set to SUID mode, and the owner is the Root account.

[0015] Preferably, the key extraction tool getidrsa only allows reading and returning the SSH private key file of the target account, and does not provide other file access permissions.

[0016] Preferably, when the key extraction tool getidrsa is called, it is combined with a C language module through a Shell script and automatically switches to Root authority for execution.

[0017] Preferably, the chuser tool consists of a Shell script and a C language module, and only allows switching to a non-root common user account.

[0018] Preferably, the chuser tool permissions are r-xr-x--x, and the owner is a specific operation and maintenance support engineer account.

[0019] Preferably, the system tool ssh automatically loads the user environment configuration file of the target account when switching accounts, including the user home directory, environment variables and command aliases.

[0020] Preferably, the system tool ssh supports transmitting the switching target account information through command line parameters or API interface when switching accounts.

[0021] Preferably, when the system tool ssh fails to switch accounts, a rollback mechanism is triggered to restore to the original user session state and release all temporary resources.

[0022] Compared with the prior art, the beneficial effects of the present invention are as follows: the account switching tool based on SSH key non-root account proposes a non-root account switching tool based on SSH key, which realizes a safe, efficient and auditable user identity switching method by combining SSH key with non-root account switching operation. The tool is suitable for multi-user server environment, especially for scenarios where root account operations are restricted or strict permission control is required;

[0023] 1. In scenarios where you need to frequently switch to multiple non-root accounts to perform operation and maintenance tasks, the tool of the present invention can significantly improve the switching efficiency and reduce the operation of manually entering passwords;

[0024] 2. In systems where direct use of the root account is prohibited, operation and maintenance personnel can use this tool to safely switch to a specific non-root account to ensure system security and compliance;

[0025] 3. The account switching tool can be embedded in the automation script, automatically switch to the target account and perform subsequent operations according to the script logic to realize batch task processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a flow chart of the account switching tool of the present invention;

[0027] Figure 2 This is a diagram of the account switching tool architecture of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] See also Figure 1 The present invention provides a technical solution: an account switching tool based on an ssh key non-root account, comprising the following steps:

[0030] Step 1: Receive and verify the target account parameter inputname input by the user through the parameter input module;

[0031] Step 2: First, determine whether to switch to root. Since the purpose is to switch users without obtaining root permissions, it is forbidden to use this tool to switch to root. So first check whether the inputusername is root. If yes, the program will report an error and exit.

[0032] Step 3: Next, determine whether the user executing the program is a specific account. That is, only a specific operation and maintenance support engineer account can be allowed to switch to other computing accounts. If the specified task is another account, the program will report an error and exit. After successfully obtaining the secret key of the target account, switch to the target account and enter the computing environment of the target account.

[0033] Step 4: Call the key extraction tool getidrsa with SUID permission through the key extraction module to obtain the SSH private key file of the inputname account with root permission;

[0034] Step 5: Switch to the target account based on the SSH private key file by calling the system tool ssh, and enter the computing environment of the target account;

[0035] Step 6: Record the switching log, which includes input parameters, switching target account, initiating user, switching time and switching result;

[0036] Step 7: After the switch is completed, the temporarily generated SSH private key file is automatically cleaned up to ensure system security;

[0037] Among them, the step 5 is specifically: returning the extracted SSH private key to the switching tool core component chuser, and completing the switching operation from the current user to the target account using the SSH protocol through the chuser tool.

[0038] When using the account switching tool based on the ssh key non-root account, the user enters the target account parameter inputname through the command line. The tool verifies whether the input account is a legal non-root account and determines whether the current user is a specific operation and maintenance support engineer. If the verification fails, the tool exits directly and outputs an error prompt.

[0039] The tool calls getidrsa, switches to root privileges through SUID mode, extracts the corresponding SSH private key from the target account's key file storage path, passes the obtained SSH private key file to the chuser tool, and uses the SSH protocol to achieve seamless switching from the current user to the target account.

[0040] The tool records detailed information about the switching operation, including input parameters, target account, initiating user, switching time, and results, and stores the logs in encrypted form to ensure traceability. After the switch is completed, the tool automatically cleans up the temporarily generated SSH private key file to prevent sensitive information leakage.

[0041] like Figure 2, chuser is a binary file compiled from chuser.c. chuser.c calls the chuser.sh script, which makes multiple judgments and uses system tools to query the home directory of the target user. After obtaining the secret key, the system tool ssh is used to switch to the target account. The chuser file attributes are those of ordinary executable files, that is, 550, and the owner is a specific account.

[0042] getidrsa is a binary file compiled from getidrsa.c. It is only used to copy the target account's key file and set the key file as a property of a specific account. In order to successfully obtain the key file, you need to set the owner of getidrsa to root and set u+s permissions. Run getidrsa with root permissions.

[0043] When the getidrsa tool is executed, SUID is set to root and the execution operation is strictly controlled, that is, only the key content is read and written, and no other operations are performed. A specific account is allowed to read the key file of the target account without obtaining root permissions. This is the entire working process of the account switching tool based on the ssh key non-root account.

[0044] The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in this field.

[0045] Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An account switching tool based on ssh key non-root account, characterized in that: The following steps are involved: Step 1: Receive and verify the target account parameter inputname input by the user through the parameter input module; Step 2, determine whether the inputname is a root account, if so, exit the program directly; Step 3: determine whether the user currently executing the tool is a specific operation and maintenance support engineer account through the user identity authentication module, and if not, exit the program; Step 4: Call the key extraction tool getidrsa with SUID permission through the key extraction module to obtain the SSH private key file of the inputname account with root permission; Step 5: Switch to the target account based on the SSH private key file by calling the system tool ssh, and enter the computing environment of the target account; Step 6: Record the switching log, which includes input parameters, switching target account, initiating user, switching time and switching result; Step 7: After the switch is completed, the temporarily generated SSH private key file is automatically cleaned up to ensure system security; Among them, the step 5 is specifically: returning the extracted SSH private key to the switching tool core component chuser, and completing the switching operation from the current user to the target account using the SSH protocol through the chuser tool.

2. According to claim 1, an account switching tool based on ssh key non-root account is characterized in that: The key extraction tool getidrsa has permissions set to SUID mode, and the owner is the Root account.

3. According to claim 2, an account switching tool based on ssh key non-root account is characterized in that: The key extraction tool getidrsa only allows reading and returning the SSH private key file of the target account, and does not provide other file access permissions.

4. According to claim 3, an account switching tool based on ssh key non-root account is characterized in that: When the key extraction tool getidrsa is called, it is combined with the C language module through the Shell script and automatically switches to the root authority for execution.

5. According to claim 1, an account switching tool based on ssh key non-root account is characterized in that: The chuser tool consists of a Shell script and a C language module, and only allows switching to a non-root common user account.

6. The account switching tool based on ssh key non-root account according to claim 5, characterized in that: The chuser tool permissions are r-xr-x--x, and the owner is a specific operation and maintenance support engineer account.

7. The account switching tool based on ssh key non-root account according to claim 1, characterized in that: The system tool ssh automatically loads the user environment configuration file of the target account when switching accounts, including the user home directory, environment variables and command aliases.

8. The account switching tool based on ssh key non-root account according to claim 7, characterized in that: The system tool ssh supports transmitting the switching target account information through command line parameters or API interface when performing account switching.

9. The account switching tool based on ssh key non-root account according to claim 8, characterized in that: When the system tool ssh fails to switch accounts, a rollback mechanism is triggered to restore the original user session state and release all temporary resources.

Images