2 (remote authenticated command execution with ACLs)
3 Maintained by Russ Allbery <eagle@eyrie.org>
5 Copyright 2015-2022 Russ Allbery <eagle@eyrie.org>. Copyright 2002-2014
6 The Board of Trustees of the Leland Stanford Junior University. This
7 software is distributed under a BSD-style license. Please see the
8 section LICENSE below for more information.
12 remctl is a client/server application that supports remote execution of
13 specific commands, using Kerberos GSS-API for authentication.
14 Authorization is controlled by a configuration file and ACL files and
15 can be set separately for each command, unlike with rsh. remctl is like
16 a Kerberos-authenticated simple CGI server, or a combination of Kerberos
17 ssh and sudo without most of the features and complexity of either.
21 remctl is a client/server application that supports remote execution of
22 specific commands, using Kerberos GSS-API for authentication and
23 confidentiality. The commands a given user can execute are controlled
24 by a configuration file and ACL files and can easily be tightly limited,
25 unlike with rsh. The mapping of command to backend program is done by
26 the configuration file, which allows some additional flexibility
27 compared to ssh command restrictions and works with Kerberos
28 authentications rather than being limited to public key authentications.
30 remctld is very similar to a CGI server that uses a different network
31 protocol than HTTP, always does strong authentication before executing
32 the desired command, and guarantees the data is encrypted on the
33 network. Alternately, you can think of it as a very simple combination
34 of Kerberos ssh and sudo, without most of the features of both but with
35 simpler authorization.
37 There are a lot of different client/server systems that do something
38 similar: current packages like gRPC, and a wealth of older systems like
39 rsh, CGI, CERN's arc, and more elaborate systems like MIT's Moira.
40 remctl has the advantage over many of these schemes of using GSS-API and
41 being about as simple as it possibly can be while still being useful.
42 It doesn't require any particular programming language, builds
43 self-contained binaries, and uses as minimal of a protocol as possible.
45 Both C and Java clients and servers are provided, as well as Perl, PHP,
46 Python, and Ruby bindings for the C client library. For more
47 information about the Java client, see java/README. For more
48 information about the PHP bindings, see php/README. For more
49 information about the Python bindings, see python/README. For more
50 information about the Ruby bindings, see ruby/README.
52 Also included in the remctl package is an alternate way of running the
53 remctl server: remctl-shell. This program is designed to be run as
54 either a shell or a forced command under ssh, using ssh for
55 authentication and communicating the authentication information to
56 remctl-shell via either environment variables or command-line arguments
57 via the forced command configuration. This version of the server uses
58 simple ssh clients, rather than using the remctl client program or
61 remctl was originally written by Anton Ushakov as a replacement for
62 IBM's sysctl, a client/server application with Kerberos v4
63 authentication that allowed the client to run Tcl code on the server,
64 protected by ACLs. At Stanford, we used sysctl extensively, but mostly
65 only to run external programs, so remctl was developed as a Kerberos v5
66 equivalent that did only the portions we needed.
68 Complete protocol documentation is available in docs/protocol.html.
69 Also present, as docs/design.html, is the original design document (now
70 somewhat out of date).
74 The remctld server and the standard client are written in C and require
75 a C compiler and GSS-API libraries to build. Both will build against
76 either MIT Kerberos or Heimdal of any reasonable vintage. remctl will
77 also build against the Kerberos GSS-API implementation shipped with AIX
78 5.2 (and possibly later versions) and the Solaris 10 generic GSS-API
79 library (and possibly later versions). The remctl_set_ccache
80 implementation is improved by building with Kerberos libraries and a
81 GSS-API library that supports gss_krb5_import_cred.
83 The remctld server requires libevent 1.4.x or later. It was only tested
84 with libevent 1.4.13-stable and later, but should work with 1.4.4 or
85 later. It is now only tested with libevent 2.x, so moving to a later
86 version of libevent if possible is recommended.
88 The remctl server will support regex ACLs if the system supports the
89 POSIX regex API. The remctl server also optionally supports PCRE
90 regular expressions in ACLs. To include that support, the PCRE library
91 (either PCRE2 or PCRE1) is required.
93 To build the remctl client for Windows, the Microsoft Windows SDK for
94 Windows Vista and the MIT Kerberos for Windows SDK are required, along
95 with a Microsoft Windows build environment (probably Visual Studio).
96 remctl has only been tested with the 3.2.1 MIT Kerberos for Windows SDK.
97 To run the resulting binary, MIT Kerberos for Windows must be installed
98 and configured. The client was tested on Windows XP and Vista and
99 should work on Windows 2000 and up; however, the primary maintainer does
100 not use or test Windows, so it's always possible Windows support has
101 broken. The server is not supported on Windows.
103 To build the Perl bindings for the C client library, you will need Perl
106 To build the PHP bindings for the C client library, you will need PHP
107 5.x or later and phpize, plus any other programs that phpize requires.
108 PHP 5.x support has only been tested on 5.2 and 5.3, and PHP support is
109 now only tested on PHP 7.x and later.
111 To build the Python bindings for the C client library, you will need
112 Python 2.7, or Python 3.1 or later. You will also need the setuptools
113 and pytest modules and, for Python 2, the typing module. Earlier
114 versions may work back to possibly Python 2.3, but are not tested.
116 To build the Ruby bindings for the C client library, you will need Ruby
117 1.8 or later (primarily tested with 2.5 and later).
119 None of the language bindings have been tested on Windows.
121 A Java client and Java server are available in the java subdirectory,
122 but they are not integrated into the normal build or built by default.
123 There is a basic Makefile in that directory that may require some
124 tweaking. It currently requires the Sun Java JDK (1.4.2, 5, or 6) or
125 OpenJDK 6 or later. A considerably better Java client implementation is
126 available on the java branch in the Git repository but has not yet been
129 To bootstrap from a Git checkout, or if you change the Automake files
130 and need to regenerate Makefile.in, you will need Automake 1.11 or
131 later. For bootstrap or if you change configure.ac or any of the m4
132 files it includes and need to regenerate configure or config.h.in, you
133 will need Autoconf 2.64 or later. Perl is also required to generate
134 manual pages from a fresh Git checkout. You will also need pkg-config
135 installed to regenerate configure and xml2rfc to build the formatted
136 protocol documentation.
138 BUILDING AND INSTALLATION
140 You can build and install remctl with the standard commands:
146 If you are building from a Git clone, first run ./bootstrap in the
147 source directory to generate the build files. make install will
148 probably have to be done as root. Building outside of the source
149 directory is also supported, if you wish, by creating an empty directory
150 and then running configure with the correct relative path.
152 Solaris users should look at examples/remctld.xml, an SMF manifest for
153 running the remctld daemon.
155 To also build the Perl bindings for the libremctl client library, pass
156 the --enable-perl option to configure. The Perl module build is handled
157 by the normal Perl extension build system, and therefore will be built
158 with compiler flags defined by your Perl installation and installed into
159 your local Perl module directory regardless of the --prefix argument to
160 configure. To change this, you will need to run perl Makefile.PL in the
161 perl subdirectory of the build tree with appropriate options and rebuild
162 the module after running make and before running make install.
164 To also build the remctl PECL extension for PHP, pass the --enable-php
165 option to configure. The PHP PECL module build is handled by the normal
166 PHP extension build system and therefore will be installed into your
167 local PHP module directory. The configure script will look for phpize
168 on your PATH by default; if it's in some other directory, set the PHPIZE
169 environment variable to the full path or set it on the configure command
170 line. The configure script for the PECL extension will be run during
171 the build instead of during configure. This is unfortunately apparently
172 unavoidable given how the PECL build system works.
174 To also build the Python bindings for the libremctl client library, pass
175 the --enable-python option to configure. The Python module build is
176 handled by the normal Python extension build system, and therefore will
177 be installed into your local Python module directory regardless of the
178 --prefix argument to configure. To change this, you will need to run
179 python setup.py install by hand in the python directory with whatever
180 options you want to use.
182 To also build the Ruby bindings for the libremctl client library, pass
183 the --enable-ruby option to configure. The Ruby module build is handled
184 by the normal Ruby module build system, and therefore will be installed
185 into your local Ruby module directory regardless of the --prefix
186 argument to configure. To change this, override the sitedir variable on
187 the make install command line, as in:
189 make install sitedir=/opt/ruby
191 The remctl build system also supports a few other environment variables
192 that can be set to control aspects of the Perl, Python, and Ruby binding
193 build systems. These are primarily only of use when packaging the
194 software. For more information, a list of the variables, and their
195 effects, see the comment at the start of Makefile.am.
197 The Java client and server aren't integrated with the regular build
198 system. For information on building and installing them, see
201 remctl will use pkg-config if it's available to find the build flags for
202 libevent. You can control which pkg-config binary and paths are used
203 with the normal pkg-config environment variables of PKG_CONFIG,
204 PKG_CONFIG_PATH, and PKG_CONFIG_LIBDIR, and you can override the
205 pkg-config results with LIBEVENT_CFLAGS and LIBEVENT_LIBS. Alternately,
206 you can bypass pkg-config by passing one or more of --with-libevent,
207 --with-libevent-include, and --with-libevent-lib to indicate the install
208 prefix, include directory, or library directory.
210 remctl will automatically build with PCRE support if PCRE2 or PCRE1 are
211 found. As with libevent, remctl will use pkg-config if it's available
212 to find the build flags for PCRE2. Use the same variables as documented
213 by libevent to control which pkg-config is used, and override its
214 results with PCRE2_CFLAGS and PCRE2_LIBS. For PCRE1, the pcre-config
215 script will be used. You can set PCRE_CONFIG to point to a different
216 pcre-config script, or do similar things as with PATH_KRB5_CONFIG
217 described below. Alternately, you can bypass pkg-config by passing one
218 or more of --with-pcre2, --with-pcre2-include, --with-pcre2-lib,
219 --with-pcre, --with-pcre-include, or --with-pcre-lib to indicate the
220 install prefix, include directory, or library directory.
222 remctl will automatically build with GPUT support if the GPUT header and
223 library are found. You can pass --with-gput to configure to specify the
224 root directory where GPUT is installed, or set the include and library
225 directories separately with --with-gput-include and --with-gput-lib.
227 Normally, configure will use krb5-config to determine the flags to use
228 to compile with your Kerberos libraries. To specify a particular
229 krb5-config script to use, either set the PATH_KRB5_CONFIG environment
230 variable or pass it to configure like:
232 ./configure PATH_KRB5_CONFIG=/path/to/krb5-config
234 If krb5-config isn't found, configure will look for the standard
235 Kerberos libraries in locations already searched by your compiler. If
236 the the krb5-config script first in your path is not the one
237 corresponding to the Kerberos libraries you want to use, or if your
238 Kerberos libraries and includes aren't in a location searched by default
239 by your compiler, you need to specify a different Kerberos installation
240 root via --with-krb5=PATH. For example:
242 ./configure --with-krb5=/usr/pubsw
244 You can also individually set the paths to the include directory and the
245 library directory with --with-krb5-include and --with-krb5-lib. You may
246 need to do this if Autoconf can't figure out whether to use lib, lib32,
247 or lib64 on your platform.
249 To not use krb5-config and force library probing even if there is a
250 krb5-config script on your path, set PATH_KRB5_CONFIG to a nonexistent
253 ./configure PATH_KRB5_CONFIG=/nonexistent
255 krb5-config is not used and library probing is always done if either
256 --with-krb5-include or --with-krb5-lib are given.
258 GSS-API libraries are found the same way: with krb5-config by default if
259 it is found, and a --with-gssapi=PATH flag to specify the installation
260 root. PATH_KRB5_CONFIG is similarly used to find krb5-config for the
261 GSS-API libraries, and --with-gssapi-include and --with-gssapi-lib can
262 be used to specify the exact paths, overriding any krb5-config results.
264 Pass --enable-silent-rules to configure for a quieter build (similar to
265 the Linux kernel). Use make warnings instead of make to build with full
266 compiler warnings (requires either GCC or Clang and may require a
267 relatively current version of the compiler).
269 You can pass the --enable-reduced-depends flag to configure to try to
270 minimize the shared library dependencies encoded in the binaries. This
271 omits from the link line all the libraries included solely because other
272 libraries depend on them and instead links the programs only against
273 libraries whose APIs are called directly. This will only work with
274 shared libraries and will only work on platforms where shared libraries
275 properly encode their own dependencies (this includes most modern
276 platforms such as all Linux). It is intended primarily for building
277 packages for Linux distributions to avoid encoding unnecessary shared
278 library dependencies that make shared library migrations more difficult.
279 If none of the above made any sense to you, don't bother with this flag.
283 remctl comes with a comprehensive test suite, but it requires some
284 configuration in order to test anything other than low-level utility
285 functions. For the full test suite, you will need to have a keytab that
286 can authenticate to a running KDC. Using a test KDC environment, if you
287 have one, is recommended.
289 Follow the instructions in tests/config/README to configure the test
292 Now, you can run the test suite with:
296 If a test fails, you can run a single test with verbose output via:
298 tests/runtests -o <name-of-test>
300 Do this instead of running the test program directly since it will
301 ensure that necessary environment variables are set up.
303 On particularly slow or loaded systems, you may see intermittant
304 failures from the server/streaming test because it's timing-sensitive.
306 The test suite will also need to be able to bind to 127.0.0.1 on port
307 11119 and 14373 to run test network server programs.
309 To test anonymous authentication, the KDC configured in the test suite
310 needs to support service tickets for the anonymous identity (not a
311 standard configuration). This test will be skipped if the KDC does not
314 To test user handling in remctld, you will need the fakeroot command
315 (available in the fakeroot package in Debian and Ubuntu). This test
316 will be skipped if fakeroot isn't available.
318 The following additional Perl modules will be used by the test suite for
319 the main package and the Perl bindings if installed:
321 * Test::MinimumVersion
324 * Test::Pod::Coverage
329 All are available on CPAN. Those tests will be skipped if the modules
332 To enable tests that don't detect functionality problems but are used to
333 sanity-check the release, set the environment variable RELEASE_TESTING
334 to a true value. To enable tests that may be sensitive to the local
335 environment or that produce a lot of false positives without uncovering
336 many problems, set the environment variable AUTHOR_TESTING to a true
341 (These instructions are not tested by the author and are now dated.
342 Updated instructions via a pull request, issue, or email are very
345 First, install the Microsoft Windows SDK for Windows Vista if you have
346 not already. This is a free download from Microsoft for users of
347 "Genuine Microsoft Windows." The vcvars32.bat environment provided by
348 Visual Studio may work as an alternative, but has not been tested.
350 Next, install the MIT Kerberos for Windows SDK [1]. remctl has been
351 tested with version 3.2.1 but should hopefully work with later versions.
353 [1] https://web.mit.edu/kerberos/www/dist/index.html
355 Then, follow these steps:
357 1. Run the InitEnv.cmd script included with the Windows SDK with
358 parameters "/xp /release".
360 2. Run the configure.bat script, giving it as an argument the location
361 of the Kerberos for Windows SDK. For example, if you installed the
362 KfW SDK in "c:\KfW SDK", you should run:
364 configure "c:\KfW SDK"
366 3. Run nmake to start compiling. You can ignore the warnings.
368 If all goes well, you will have remctl.exe and remctl.dll. The latter
369 is a shared library used by the client program. It exports the same
370 interface as the UNIX libremctl library.
374 The remctl web page at:
376 https://www.eyrie.org/~eagle/software/remctl/
378 will always have the current version of this package, the current
379 documentation, and pointers to any additional resources.
381 For bug tracking, use the issue tracker on GitHub:
383 https://github.com/rra/remctl/issues
385 However, please be aware that I tend to be extremely busy and work
386 projects often take priority. I'll save your report and get to it as
387 soon as I can, but it may take me a couple of months.
391 remctl is maintained using Git. You can access the current source on
394 https://github.com/rra/remctl
396 or by cloning the repository at:
398 https://git.eyrie.org/git/kerberos/remctl.git
400 or view the repository via the web at:
402 https://git.eyrie.org/?p=kerberos/remctl.git
404 The eyrie.org repository is the canonical one, maintained by the author,
405 but using GitHub is probably more convenient for most purposes. Pull
406 requests are gratefully reviewed and normally accepted.
410 The remctl package as a whole is covered by the following copyright
411 statement and license:
413 Copyright 2015-2022 Russ Allbery <eagle@eyrie.org>
415 The Board of Trustees of the Leland Stanford Junior University
417 Permission is hereby granted, free of charge, to any person obtaining
418 a copy of this software and associated documentation files (the
419 "Software"), to deal in the Software without restriction, including
420 without limitation the rights to use, copy, modify, merge, publish,
421 distribute, sublicense, and/or sell copies of the Software, and to
422 permit persons to whom the Software is furnished to do so, subject to
423 the following conditions:
425 The above copyright notice and this permission notice shall be
426 included in all copies or substantial portions of the Software.
428 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
429 EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
430 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
431 IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
432 CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
433 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
434 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
436 Some files in this distribution are individually released under
437 different licenses, all of which are compatible with the above general
438 package license but which may require preservation of additional
439 notices. All required notices, and detailed information about the
440 licensing of each file, are recorded in the LICENSE file.
442 Files covered by a license with an assigned SPDX License Identifier
443 include SPDX-License-Identifier tags to enable automated processing of
444 license information. See https://spdx.org/licenses/ for more
447 For any copyright range specified by files in this package as YYYY-ZZZZ,
448 the range specifies every single year in that closed interval.