Sending shutdown command via ssh using sudo non-interactively

Question

With iOS 12 and the new Siri Shortcuts app, I've been thinking of ways I could leverage the SSH command capability in the app. For those of you who don't know, the app allows you to send a bash file or string to stdin and returns stdout as a plain-text file, connecting using password authentication (no token authentication).

What I'd like to do is create a shortcut that executes sudo shutdown [...] on a remote server via the SSH command action. Since the action is non-interactive and non-tty I can't interactively enter the password, and I'm reluctant to put the password as plaintext in the action input string/stdin. On the other hand, I don't want to use sudo -n and NOPASSWD for the shutdown command, as that's a security risk that I don't want to deal with. I thought of perhaps requiring a random string for the shutdown message for NOPASSWD to be enabled in the sudoers file (i.e., sudo shutdown -h now would require a password, but sudo shutdown -h now japos98vh92p3hoab982hfpa would not), but I don't know if that's any more secure or even possible.

In summary, how can I securely send a shutdown command over SSH using a non-interactive, non-tty session?

Answer 1

There are a bunch of different questions in here, some of which are not security questions (for example "how to use sudo over a non-interactive SSH session" is really a programming / superuser question), and some of which only you can answer (what counts as "secure").

So instead of answering your question directly, I'll point out some security things to think about relating to your two proposals.

I don't want to use sudo -n and NOPASSWD for the shutdown command, as that's a security risk that I don't want to deal with.

You may need to elaborate on what that security risk is and why you don't want to deal with it. Clearly you're OK with Siri knowing your username and password to SSH in, which, if the iOS devs were to build in a mechanism for handling sudo prompts or an attacker were to extract your username/passwd from Siri's storage, would be enough to perform any admin action on that machine.

The reason that sudo needs a password is to prevent you downloading malware in firefox, and then it turning itself into root. From the use-case you describe in your question, whether ssh user@machine 'sudo cmd' requires you to type your password once or twice doesn't make a difference from a security perspective; either the attacker knows your password, or they don't.

sudo shutdown -h now japos98vh92p3hoab982hfpa

I don't know how you would accomplish this (but would love to learn if you can explain how in comments!). Skipping that (and any potential security holes you open in the process), I suppose this becomes a second admin password so that an attacker needs to know both your account password and this "admin password" in order to execute shutdown. This "admin password" will show up in more places: in plaintext in the Siri app, in the bash history for your user, in the process tree while it's running (try ps -u), and probably other places -- there's a reason things like sudo take passwords via stdin, not via command-line arguments.

So assuming

1. An attacker has gotten in to your account - either over SSH or because you downloaded malware in firefox and ran it
2. You have run this command before and it's in your bash history

I'm not sure there's any difference security-wise between this and setting shutdown to be NOPASSWD.

Answer 2

I figured out how to do it using NOPASSWD and a random string. I added the following lines to my sudoers file:

matt  ALL=(ALL) NOPASSWD: /sbin/shutdown -h now japos98vh92p3hoab982hfpa
matt  ALL=(ALL) NOPASSWD: /sbin/reboot japos98vh92p3hoab982hfpa

This worked just like I wanted. :)