Bash: permission denied

Question

I want to SSH to remote server and run a python script which uses sqlplus to connect to Oracle DB. SSH works fine:

os.system('sudo ssh Hostname python < sql.py')

The sql.py returns this error message:

('', 'bash: sqlplus: Permission denied\n'))
('Line :', '')
('Line :', 'bash: sqlplus: Permission denied\

Any clues? Cx_oracle is not an option since my Python version is 2.6.

Thanks:)

Here is sql.py:

#!/usr/bin/python
import subprocess
from subprocess import Popen, PIPE

sql="select * from dba_users;"

def connectDB(sql):
    p = subprocess.Popen(['su','oracle','sqlplus','/ as sysdba','shell = True'],stdin=subprocess.PIPE,
    stdout=subprocess.PIPE,stderr=subprocess.PIPE)
    stdout_lines= p.communicate(sql)
    return stdout_lines

sqlplus_output = connectDB(sql)

for line in sqlplus_output:
    print("Line :" ,line)

The `shell=True` is causing every argument except for `su` to be ignored, so it isn't even running `su oracle`, much less `su oracle sqlplus '/ as sysdba'`. — Charles Duffy, Feb 22 '19 at 14:31
That said, there's a *lot* here that qualifies as a code smell, particularly with my security hat on. Running the SSH client as root is a smell; granting root an dropping from there to oracle is a smell (vs logging in as an unprivileged account and having a narrow / fine-grained way to escalate from there to oracle, hopefully only to run a specific, known, audited command), etc; if I were a red team member who'd managed to get a toehold in one of the servers involved in this infrastructure, the general smell here is that there would be no impedance against escalation and lateral movement. — Charles Duffy, Feb 22 '19 at 14:33
(Having passwordless login between the root accounts on your servers -- which is why I assume you're doing the `sudo ssh` -- is *also* a smell, especially when `sudo` is passwordless and so loosely restricted as to be usable by scripts; means anyone who can escalate privileges can move across your infrastructure effortlessly). — Charles Duffy, Feb 22 '19 at 14:37
What happens when you invoke the script being in the shell, I mean after being logged in to the system? — James Jithin, Feb 22 '19 at 14:37
You can use an older version of cx_Oracle. Since cx_Oracle can connect with SYSDBA privileges, and (with a bit of discipline) can make Python read a SQL script and execute the SQL statements, it would be better to do all the processing in Python. Look at https://github.com/oracle/python-cx_Oracle/blob/master/samples/SampleEnv.py which will run a SQL file like https://github.com/oracle/python-cx_Oracle/blob/master/samples/sql/SetupSamplesExec.sql — Christopher Jones, Feb 25 '19 at 00:23

Bash: permission denied

0 Answers0