Commands that the remote inventory task runs on Linux computers.

[alexmicontini]

Hello @g-bougard ,
About the remote inventory task to inventory Linux computers by SSH, either with a username and password or with a public key system, what commands does the agent that executes the remote inventory task execute to inventory and collect remote computers? The point is that we want to limit the commands that the ssh-connected user can execute to those strictly necessary for the inventory. For example the commands ls, top, dmidecode, etc..
Where in the source code can I see the commands that the remote inventory task executes?

[g-bougard]

Hi @alexmicontini
the problem is some part of an inventory can be done if the agent only found a given command. You can limit the access to a given set of command, but it's actually a huge work to identify all the command the agent could require. In code, you'll generally see used command as parameter to GetFileHandle/GetAllLines/GetFirstLine/GetLastLine/GetFirstMatch function calls. And the parameter should look like: command => 'dmidecode ...'. Sometime the parameter is transmitted to a parent function. Sometime, the %params structure is modified to include the "command" parameter. You can also look for canRun() API calls.
If I take an example for GLPI::Agent::Task::Inventory::Linux::Storages module, it can use the following commands:

• hdparm
• fdisk
• lvm
• /usr/bin/lshal

For linux, you check for command usage under /lib/GLPI/Agent/Task/Inventory/{Generic,Linux} folders & /lib/GLPI/Agent/Tools/{Generic,Linux,Unix,IpmiFru}.pm files.
Also for the RemoteInventory task support, you may need to be able to run the following commands: id, cat, sh, test, uname, hostname, readlink and possibly perl if you use "perl" mode (see modes). I checked /lib/GLPI/Agent/Task/RemoteInventory/Remote/SSH.pm for theses ones.

[alexmicontini]

Hi @g-bougard,

Thank you very much for answering. I will forward your response to the security department of my company.

Best regards.