alpacon token acl command
Manage command ACL rules for an API token. Configure which server-side shell commands the token is allowed to execute via alpacon exec or non-interactive alpacon websh SERVER "command".
Deny-by-default: if no command ACL exists for a token, all remote command execution is denied.
alpacon token acl command [flags]
alpacon token acl command [command]Options
-h, --help help for commandWildcard patterns
Use * as a wildcard to match any arguments:
| ACL rule | Matches | Does not match |
|---|---|---|
whoami | whoami (exact) | whoami --help |
echo * | echo "hello", echo foo bar | echo (no arguments) |
systemctl status * | systemctl status nginx, systemctl status app | systemctl restart nginx |
docker compose * | docker compose up -d, docker compose ps | docker run nginx |
sudo systemctl restart nginx | sudo systemctl restart nginx | systemctl restart nginx, sudo -n systemctl restart nginx |
A trailing * requires at least one argument, so allow the bare form with a second rule.
Rules are matched against the command line you submit, not the command that runs as root, which means a rule for a privileged command must include the sudo prefix. Sudo policies use the opposite convention.
Never add a sudo * rule. Wildcards match across quoting, so it also allows sudo bash -c "rm -rf /". See Command patterns and sudo.
Examples
# Exact match
alpacon token acl command add my-api-token --command="whoami"
# Wildcard
alpacon token acl command add my-api-token --command="systemctl status *"
# Privileged command: the sudo prefix is part of the rule
alpacon token acl command add my-api-token --command="sudo systemctl restart nginx"
# List all command ACLs
alpacon token acl command ls my-api-token