custodian-enqueue
-----------------

  We open named files from the user to parse tests.  The configuration file(s)
 are currently opened by root, via /etc/service/custodian-enqueue.  This should
 be changed to run as a lower-privileged user.



custodian-dequeue
-----------------

Two tests pass arguments from the configuration file to the shell:

    ping
    http/https

The hostname used to ping, and the URL for web-tests, are both passed directly to the shell with no encoding or sanitizing.  The only issue is that the hostnames must match the following regular expression:

^([^\s]+)\s+

The following configuration file allows the specified command to be executed, as the user running the dequeue tool, via the shell:

    $(/home/steve/hg/custodian/exploit.sh) must ping otherwise "Owned".

Given that anybody who can talk to the beanstalkd server can submit JSON-encoded-jobs we have no solution here which involves sanity-checking the parsed-hostnames.  Instead we much either restrict submissions to signed ones, or we must remove the following from hostnames:

    $( ... )  - Expansion.
    ` .. `    - Backticks.
    ; ..      - Sub-commands.

That has not yet been done, but it is definitely on the map.



General
-------

We decode arbitrary JSON from the queue.  We should sign it, or validate it to  will prevent trojan malformed
JSON from being added.

At the moment we ensure that the job-body we retrieve looks JSON-like, and decodes to a non-empty hash.

Problem: We cannot sign the body without giving away our key details.

Solution: Read /etc/custodian/salt, and store the checksum of all keys + values with that salt?


TODO
----

  Anything else?  DoS attacks?



Steve
--