# US 2020/0401712 A1 · Command line interface replacement for security purposes > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0401712 A1 - Document ID: US20200401712A1 - Status: Published application - Kind: A1 - Application number: 17/009,418 - Filed: 2020-09-01 - Published: 2020-12-24 - Earliest claimed: 2018-03-01 - Assignees: Gil KEINI - Inventors: David KEINI - Web page: https://patentgrep.com/patent/US20200401712A1 ## CPC - G06F 21/629: {to features or functions of an application} - G06F 21/31: User authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer program product, a computerized apparatus and a method for strengthening the security of Command Line Interface (CLI) of an Operating System (OS), by limiting the allowed operations via the CLI. The method comprises: obtaining a user account having an access to the OS via a CLI configured to receive commands from the user and execute a predetermined functionality in the OS; creating an operation profile for the user account having a list of authorized commands in the CLI for the user account that excludes a command of the CLI or a parameter thereof; and deploying a CLI-Replacement Component (CRC) in the OS that is associated with the user account. The CRC is a CLI layer that is configured to limit executed commands in the OS based on the operation profile, whereby the CRC only sends commands adhering with the operation profile for execution by the OS. ## Claims ### Claim 1 A method comprising: obtaining a user account having an access to an Operating System (OS), wherein the OS comprises a Command Line Interface (CLI) configured to receive commands from the user and execute a predetermined functionality in the OS; creating an operation profile for the user account, wherein the operation profile comprises a list of authorized commands in the CLI for the user account, wherein the operation profile excludes at least one command of the CLI or at least one parameter of a command of the CLI; and deploying a CLI-Replacement Component (CRC) in the OS, wherein the CRC is associated with the user account, wherein the CRC is a CLI layer that is configured to limit executed commands in the OS based on the operation profile, whereby the CRC only sends commands adhering with the operation profile for execution by the OS. ### Claim 2 (depends on 1) The method of claim 1, further comprises: generating the CRC based on the predetermined functionality and the operation profile of the user account. ### Claim 3 (depends on 1) The method of claim 1, wherein said creating the operation profile is performed based on assignments with which the user is tasked. ### Claim 4 (depends on 1) The method of claim 1, wherein limiting the executed commands by the CRC is indifferent to file permissions in a file system of the OS, whereby the CRC prevents execution of a command for which the user account has execution permissions in the file system. ### Claim 5 (depends on 1) The method of claim 1, further comprising: obtaining a second user account having an access to the OS, wherein the second user account is associated with a second user of the OS; creating a second operation profile for the second user account, wherein the second operation profile comprises a second list of authorized commands in the CLI for the second user account, wherein the second operation profile excludes at least one command of the CLI or at least one parameter of a command of the CLI; and deploying a second CLI-Replacement Component (CRC) in the OS, wherein the second CRC is associated with the second user account, wherein the second CRC is a CLI layer that is configured to limit executed commands in the OS based on the second operation profile, whereby the CRC only sends commands adhering with the second operation profile for execution by the OS; wherein the CRC and the second CRC are different. ### Claim 6 (depends on 1) The method of claim 1, wherein said creating the operation profile comprises: displaying a list of commands of the OS to an administrator of the OS; and generating the list of authorized commands based on a selection of the administrator of enabled commands from the list of commands. ### Claim 7 (depends on 6) The method of claim 6, wherein said creating the operation profile further comprises: obtaining a permission template indicating a set of enabled commands in the OS; wherein said displaying comprises displaying the list of commands and indicating the set of enabled commands as initially enabled; whereby providing the administrator with an initial list of authorized commands. ### Claim 8 (depends on 1) The method of claim 1, wherein the CRC is configured to enable execution of a first command, wherein the first command is configured to be executed in the OS with a at least one parameter; wherein based on the operation profile, the CRC is configured to prevent executing the first command with at least one value of the at least parameter of the first command. ### Claim 9 (depends on 1) The method of claim 1, wherein the operation profile limits a number of commands allowed to be executed by the OS to less than 10% of a number of commands of the OS. ### Claim 10 (depends on 1) The method of claim 1, wherein said deploying the CRC in the OS comprises replacing the CLI of the OS with the CRC, wherein said replacing comprises deleting the CLI of the OS to prevent execution of the CLI. ### Claim 11 A computerized apparatus having a processor, the processor being adapted to perform the steps of: obtaining a user account having an access to an Operating System (OS), wherein the OS comprises a Command Line Interface (CLI) configured to receive commands from the user and execute a predetermined functionality in the OS; creating an operation profile for the user account, wherein the operation profile comprises a list of authorized commands in the CLI for the user account, wherein the operation profile excludes at least one command of the CLI or at least one parameter of a command of the CLI; and deploying a CLI-Replacement Component (CRC) in the OS, wherein the CRC is associated with the user account, wherein the CRC is a CLI layer that is configured to limit executed commands in the OS based on the operation profile, whereby the CRC only sends commands adhering with the operation profile for execution by the OS. ### Claim 12 (depends on 11) The computerized apparatus of claim 11, wherein the processor is further adapted to perform the steps of: generating the CRC based on the predetermined functionality and the operation profile of the user account. ### Claim 13 (depends on 11) The computerized apparatus of claim 11, wherein said creating the operation profile is performed based on assignments with which the user is tasked. ### Claim 14 (depends on 11) The computerized apparatus of claim 11, wherein limiting the executed commands by the CRC is indifferent to file permissions in a file system of the OS, whereby the CRC prevents execution of a command for which the user account has execution permissions in the file system. ### Claim 15 (depends on 11) The computerized apparatus of claim 11, wherein the processor is further adapted to perform the steps of: obtaining a second user account having an access to the OS, wherein the second user account is associated with a second user of the OS; creating a second operation profile for the second user account, wherein the second operation profile comprises a second list of authorized commands in the CLI for the second user account, wherein the second operation profile excludes at least one command of the CLI or at least one parameter of a command of the CLI; and deploying a second CLI-Replacement Component (CRC) in the OS, wherein the second CRC is associated with the second user account, wherein the second CRC is a CLI layer that is configured to limit executed commands in the OS based on the second operation profile, whereby the CRC only sends commands adhering with the second operation profile for execution by the OS; wherein the CRC and the second CRC are different. ### Claim 16 (depends on 11) The computerized apparatus of claim 11, wherein said creating the operation profile comprises: displaying a list of commands of the OS to an administrator of the OS; and generating the list of authorized commands based on a selection of the administrator of enabled commands from the list of commands. ### Claim 17 (depends on 16) The computerized apparatus of claim 16, wherein said creating the operation profile further comprises: obtaining a permission template indicating a set of enabled commands in the OS; wherein said displaying comprises displaying the list of commands and indicating the set of enabled commands as initially enabled; whereby providing the administrator with an initial list of authorized commands. ### Claim 18 (depends on 11) The computerized apparatus of claim 11, wherein the CRC is configured to enable execution of a first command, wherein the first command is configured to be executed in the OS with a at least one parameter; wherein based on the operation profile, the CRC is configured to prevent executing the first command with at least one value of the at least parameter of the first command. ### Claim 19 (depends on 11) The computerized apparatus of claim 11, wherein said deploying the CRC in the OS comprises replacing the CLI of the OS with the CRC, wherein said replacing comprises deleting the CLI of the OS to prevent execution of the CLI. ### Claim 20 A computer program product comprising a non-transitory computer readable storage medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform a method comprising: obtaining a user account having an access to an Operating System (OS), wherein the OS comprises a Command Line Interface (CLI) configured to receive commands from the user and execute a predetermined functionality in the OS; creating an operation profile for the user account, wherein the operation profile comprises a list of authorized commands in the CLI for the user account, wherein the operation profile excludes at least one command of the CLI or at least one parameter of a command of the CLI; and deploying a CLI-Replacement Component (CRC) in the OS, wherein the CRC is associated with the user account, wherein the CRC is a CLI layer that is configured to limit executed commands in the OS based on the operation profile, whereby the CRC only sends commands adhering with the operation profile for execution by the OS.