diff options
author | 2014-01-03 17:44:12 -0400 | |
---|---|---|
committer | 2014-01-03 17:44:12 -0400 | |
commit | d79d27b97a485d44ffd14e7915a773537dd13d53 (patch) | |
tree | 999030eb1b2a0aa756198ad5636dc95e0b198d95 /Assistant/Ssh.hs | |
parent | 69882c022f0ae9619ee7f51c087990724f4d4099 (diff) |
assistant: Ensure that .ssh/config and .ssh/authorized_keys are not group or world writable when writing to those files, as that can make ssh refuse to use them, if it allows another user to write to them.
Diffstat (limited to 'Assistant/Ssh.hs')
-rw-r--r-- | Assistant/Ssh.hs | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/Assistant/Ssh.hs b/Assistant/Ssh.hs index d69c29254..82da9e33a 100644 --- a/Assistant/Ssh.hs +++ b/Assistant/Ssh.hs @@ -149,7 +149,7 @@ removeAuthorizedKeys gitannexshellonly dir pubkey = do sshdir <- sshDir let keyfile = sshdir </> "authorized_keys" ls <- lines <$> readFileStrict keyfile - writeFile keyfile $ unlines $ filter (/= keyline) ls + viaTmp writeSshConfig keyfile $ unlines $ filter (/= keyline) ls {- Implemented as a shell command, so it can be run on remote servers over - ssh. @@ -290,13 +290,15 @@ setSshConfig sshdata config = do sshdir <- sshDir createDirectoryIfMissing True sshdir let configfile = sshdir </> "config" - unlessM (catchBoolIO $ isInfixOf mangledhost <$> readFile configfile) $ + unlessM (catchBoolIO $ isInfixOf mangledhost <$> readFile configfile) $ do appendFile configfile $ unlines $ [ "" , "# Added automatically by git-annex" , "Host " ++ mangledhost ] ++ map (\(k, v) -> "\t" ++ k ++ " " ++ v) (settings ++ config) + setSshConfigMode configfile + return $ sshdata { sshHostName = T.pack mangledhost } where mangledhost = mangleSshHostName sshdata |