summaryrefslogtreecommitdiff
path: root/Assistant/Ssh.hs
Commit message (Collapse)AuthorAge
* avoid the dashed ssh hostname class of security holesGravatar Joey Hess2017-08-17
| | | | | | | | | | | | | | | | | | | | | | | | Security fix: Disallow hostname starting with a dash, which would get passed to ssh and be treated an option. This could be used by an attacker who provides a crafted ssh url (for eg a git remote) to execute arbitrary code via ssh -oProxyCommand. No CVE has yet been assigned for this hole. The same class of security hole recently affected git itself, CVE-2017-1000117. Method: Identified all places where ssh is run, by git grep '"ssh"' Converted them all to use a SshHost, if they did not already, for specifying the hostname. SshHost was made a data type with a smart constructor, which rejects hostnames starting with '-'. Note that git-annex already contains extensive use of Utility.SafeCommand, which fixes a similar class of problem where a filename starting with a dash gets passed to a program which treats it as an option. This commit was sponsored by Jochen Bartl on Patreon.
* Some optimisations to string splitting code.Gravatar Joey Hess2017-01-31
| | | | | | | | | | | | | | | | | | | Turns out that Data.List.Utils.split is slow and makes a lot of allocations. Here's a much simpler single character splitter that behaves the same (even in wacky corner cases) while running in half the time and 75% the allocations. As well as being an optimisation, this helps move toward eliminating use of missingh. (Data.List.Split.splitOn is nearly as slow as Data.List.Utils.split and allocates even more.) I have not benchmarked the effect on git-annex, but would not be surprised to see some parsing of eg, large streams from git commands run twice as fast, and possibly in less memory. This commit was sponsored by Boyd Stephen Smith Jr. on Patreon.
* webapp: Escape unusual characters in ssh hostnames when generating mangled ↵Gravatar Joey Hess2016-07-19
| | | | hostnames. This allows IPv6 addresses to be used on filesystems not supporting : in filenames.
* remove 163 lines of code without changing anything except importsGravatar Joey Hess2016-01-20
|
* use mangled hostname for gitlab repo when using a dedicated git-annex ssh keyGravatar Joey Hess2015-07-27
|
* basic gitlab support in webappGravatar Joey Hess2015-07-22
| | | | | | | This works, but needs more testing and work on cases like encrypted repos, enabling existing repositories, etc. This commit was sponsored by Shaun Westmacott.
* assistant: Fix local pairing when ssh pubkey comment contains spaces.Gravatar Joey Hess2015-02-04
|
* update my email address and homepage urlGravatar Joey Hess2015-01-21
|
* revert parentDir changeGravatar Joey Hess2015-01-09
| | | | | | | | Reverts 2bba5bc22d049272d3328bfa6c452d3e2e50e86c Unfortunately, this caused breakage on Windows, and possibly elsewhere, because parentDir and takeDirectory do not behave the same when there is a trailing directory separator.
* made parentDir return a Maybe FilePath; removed most uses of itGravatar Joey Hess2015-01-06
| | | | | | | | parentDir is less safe than takeDirectory, especially when working with relative FilePaths. It's really only useful in loops that want to terminate at / This commit was sponsored by Audric SCHILTKNECHT.
* fix some mixed space+tab indentationGravatar Joey Hess2014-10-09
| | | | | | | | | This fixes all instances of " \t" in the code base. Most common case seems to be after a "where" line; probably vim copied the two space layout of that line. Done as a background task while listening to episode 2 of the Type Theory podcast.
* webapp: Include ssh port in mangled hostname.Gravatar Joey Hess2014-06-05
| | | | | | | | | This avoids a collision if different ssh ports are used on the same host for some reason. Note that it's ok to change the format of the mangled hostname; unmangling only extracts the hostname from it, and once ssh is configured for a mangled hostname, that config is not changed.
* assistant: Adjust ssh authorized keys line generated in local pairing or for ↵Gravatar Joey Hess2014-04-02
| | | | a remote ssh server to set environment variables in an alternative way that works with the non-POSIX fix shell, as well as POSIX shells.
* webapp: Include no-pty in ssh authorized_keys lines.Gravatar Joey Hess2014-03-05
| | | | | | git-annex-shell does not need a pty, so this speeds things up. Also, it may avoid weird misconfigured systems that try to run screen or tmux on every ssh login from doing so.
* Revert "work around what is likely a bug in a new version of ssh"Gravatar Joey Hess2014-02-14
| | | | | | | This reverts commit 07ab0b85ce375c1882e13780e525aba8918c6fdf. Bug was fixed in -2 of debian package, and is fixed upstream (unsure what upstream release specificically)
* work around what is likely a bug in a new version of sshGravatar Joey Hess2014-02-14
| | | | | This avoids running into it for new setups, but does not transition old setups. Just a quick fix; I hope to get ssh fixed.
* assistant: Ensure that .ssh/config and .ssh/authorized_keys are not group or ↵Gravatar Joey Hess2014-01-03
| | | | world writable when writing to those files, as that can make ssh refuse to use them, if it allows another user to write to them.
* assistant: Set StrictHostKeyChecking yes when creating ssh remotes, and add ↵Gravatar Joey Hess2013-12-20
| | | | it to the configuration for any ssh remotes previously created by the assistant. This avoids repeated prompts by ssh if the host key changes, instead syncing with such a remote will fail. Closes: #732602
* build assistant and watcher on windows (doesn't work yet)Gravatar Joey Hess2013-11-12
|
* enabling ssh gcrypt now worksGravatar Joey Hess2013-10-01
|
* webapp can now set up gcrypt repos on ssh serversGravatar Joey Hess2013-10-01
|
* UI for making encrypted ssh remotes with gcryptGravatar Joey Hess2013-09-29
| | | | | | | | | | | | Improved probing the remote server, so it gathers a list of the capabilities it has. From that list, we can determine which types of remotes are supported, and display an appropriate UI. The new buttons for making gcrypt repos don't work yet, but the old buttons for unencrypted git repo and encrypted rsync repo have been adapted to the new data types and are working. This commit was sponsored by David Schmitt.
* webapp: Improve handling of remotes whose setup has stalled.Gravatar Joey Hess2013-07-31
| | | | | | | | | | | | | | | | | | | | | | | | | | This includes recovery from the ssh-agent problem that led to many reporting http://git-annex.branchable.com/bugs/Internal_Server_Error:_Unknown_UUID/ (Including fixing up .ssh/config to set IdentitiesOnly.) Remotes that have no known uuid are now displayed in the webapp as "unfinished". There's a link to check their status, and if the remote has been set annex-ignore, a retry button can be used to unset that and try again to set up the remote. As this bug has shown, the process of adding a ssh remote has some failure modes that are not really ideal. It would certianly be better if, when setting up a ssh remote it would detect if it's failed to get the UUID, and handle that in the remote setup process, rather than waiting until later and handling it this way. However, that's hard to do, particularly for local pairing, since the PairListener runs as a background thread. The best it could do is pop up an alert if there's a problem. This solution is not much different. Also, this solution handles cases where the user has gotten their repo into a mess manually and let's the assistant help with cleaning it up. This commit was sponsored by Chia Shee Liang. Thanks!
* set IdentitiesOnlyGravatar Joey Hess2013-07-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When setting up a dedicated ssh key to access the annex on a host, set IdentitiesOnly to prevent the ssh-agent from forcing use of a different ssh key. That behavior could result in unncessary password prompts. I remember getting a message or two from people who got deluged with password prompts and I couldn't at the time see why. Also, it would prevent git-annex-shell from being run on the remote host, when git-annex was installed there by unpacking the standalone tarball, since the authorized_keys line for the dedicated ssh key, which sets up calling git-annex-shell when it's not in path, wouldn't be used. This fixes http://git-annex.branchable.com/bugs/Internal_Server_Error:_Unknown_UUID but I've not closed that bug yet since I should still: 1. Investigate why the ssh remote got set up despite being so broken. 2. Make the webapp not handle the NoUUID state in such an ugly way. 3. Possibly add code to fix up systems that encountered the problem. Although since it requires changes to .ssh/config this may be one for the release notes. Thanks to TJ for pointing me in the right direction to understand what was happening here.
* got hdevtools working againGravatar Joey Hess2013-07-27
| | | | Fix comment to not make cpp unhappy
* webapp: Ensure that ssh keys generated for different directories on a server ↵Gravatar Joey Hess2013-06-25
| | | | are always different.
* sanity checkGravatar Joey Hess2013-06-11
|
* display any illegal character found in ssh commentGravatar Joey Hess2013-06-10
|
* rename moduleGravatar Joey Hess2013-05-12
|
* fix use of wrong shebang when android is installing git-annex-shell wrapper ↵Gravatar Joey Hess2013-05-06
| | | | on server
* expose Control.Monad.joinGravatar Joey Hess2013-04-22
| | | | | I think I've been looking for that function for some time. Ie, I remember wanting to collapse Just Nothing to Nothing.
* webapp: Include the repository directory in the mangled hostname and ssh key ↵Gravatar Joey Hess2013-04-16
| | | | name, so that a locked down ssh key for one repository is not re-used when setting up additional repositories on the same server.
* use git-annex for ssh directory nameGravatar Joey Hess2013-04-14
|
* random ssh keys (╯°□°)╯︵ ┻━┻ gnome-keyringGravatar Joey Hess2013-04-14
| | | | | | | | | | | | | | assistant: Work around horrible, terrible, very bad behavior of gnome-keyring, by not storing special-purpose ssh keys in ~/.ssh/*.pub. Apparently gnome-keyring apparently will load and indiscriminately use such keys in some cases, even if they are not using any of the standard ssh key names. Instead store the keys in ~/.ssh/annex/, which gnome-keyring will not check. Note that neither I nor #debian-devel were able to quite reproduce this problem, but I believe it exists, and that this fixes it. And it certianly won't hurt anything..
* assistant: Fix ~/.ssh/git-annex-shell wrapper to work when the ssh key does ↵Gravatar Joey Hess2013-03-12
| | | | | | | not force a command. Without a forced command, SSH_ORIGINAL_COMMAND is not set. So instead, in this case, run $@
* Makefile now builds using cabal, taking advantage of cabal's automatic ↵Gravatar Joey Hess2013-02-27
| | | | | | | | | detection of appropriate build flags. The only thing lost is ./ghci Speed: make fast used to take 20 seconds here, when rebuilding from touching Command/Unused.hs. With cabal, it's 29 seconds.
* webapp: Display any error message from git init if it fails to create a ↵Gravatar Joey Hess2013-02-26
| | | | repository.
* deal with Android's nonstandard shell locationGravatar Joey Hess2013-02-13
| | | | | | This is so gratutious and pointless. It's a shame that everything we learned about Unix portability and the importance of standards has been thrown out the window by these guys.
* fix typo in name of authorized_keys file when canceling adding a keyGravatar Joey Hess2013-01-03
|
* webapp: Allow user to specify the ssh port when setting up a remote.Gravatar Joey Hess2012-12-06
|
* assistant: Allow periods in ssh key comments.Gravatar Joey Hess2012-12-06
|
* cleanupGravatar Joey Hess2012-11-06
|
* webapp: When setting up authorized_keys, use GIT_ANNEX_SHELL_DIRECTORY.Gravatar Joey Hess2012-11-05
|
* webapp: Generate better git remote names.Gravatar Joey Hess2012-10-31
| | | | | | Wrote a better git remote name sanitizer. Git blows up on lots of weird stuff, especially if it starts the remote name, but I managed to get some common punctuation working.
* where indentationGravatar Joey Hess2012-10-31
|
* Use USER and HOME environment when set, and only fall back to getpwent, ↵Gravatar Joey Hess2012-10-25
| | | | which doesn't work with LDAP or NIS.
* webapp: Allow dashes in ssh key comments when pairing.Gravatar Joey Hess2012-10-22
|
* removed 3 partial !! and got a much nicer implementationGravatar Joey Hess2012-10-20
| | | | Yay, monadic Either!
* webapp: Avoid crashing when ssh-keygen -F chokes on an invalid known_hosts file.Gravatar Joey Hess2012-09-27
|
* use ~/.ssh/git-annex-shell wrapperGravatar Joey Hess2012-09-26
| | | | | | This was needed for the OSX self-contained app, but is a generally good idea. It avoids needing perl; is probably faster; and could eventually be replaced by something faster yet.