[
https://issues.apache.org/jira/browse/SSHD-584?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15013346#comment-15013346
]
ASF GitHub Bot commented on SSHD-584:
-------------------------------------
GitHub user alonbl opened a pull request:
https://github.com/apache/mina-sshd/pull/17
[SSHD-584] Closer to OpenSSH file permissions checks
1. Owner can be either running user or root in *NIX.
2. Config file have less restrictive requirements than keys.
I can probably remove duplicate code, but thought first to get some
feedback.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/alonbl/mina-sshd perms
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/mina-sshd/pull/17.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #17
----
commit a714abc79a933ca95c93da7da89afee1bd5ee7f8
Author: Alon Bar-Lev <[email protected]>
Date: 2015-11-19T10:57:52Z
[SSHD-584] Closer to OpenSSH file permissions checks
1. Owner can be either running user or root in *NIX.
2. Config file have less restrictive requirements than keys.
Signed-off-by: Alon Bar-Lev <[email protected]>
----
> permisison of ~/.ssh/config with group/world readable is legal
> --------------------------------------------------------------
>
> Key: SSHD-584
> URL: https://issues.apache.org/jira/browse/SSHD-584
> Project: MINA SSHD
> Issue Type: Bug
> Affects Versions: 1.1.0
> Environment: build
> Reporter: Alon Bar-Lev
>
> Got this exception:
> ---
> testAttributes(org.apache.sshd.client.subsystem.sftp.SftpFileSystemTest)
> Time elapsed: 5.581 sec <<< ERROR!
> java.io.IOException: String permission violation (GROUP_READ) for
> /home/alonbl/.ssh/config
> at
> org.apache.sshd.client.config.hosts.DefaultConfigFileHostEntryResolver.reloadHostConfigEntries(DefaultConfigFileHostEntryResolver.java:80)
> at
> org.apache.sshd.client.config.hosts.ConfigFileHostEntryResolver.resolveEffectiveResolver(ConfigFileHostEntryResolver.java:86)
> at
> org.apache.sshd.client.config.hosts.ConfigFileHostEntryResolver.resolveEffectiveHost(ConfigFileHostEntryResolver.java:59)
> at org.apache.sshd.client.SshClient.connect(SshClient.java:339)
> at
> org.apache.sshd.client.subsystem.sftp.SftpFileSystemProvider.newFileSystem(SftpFileSystemProvider.java:177)
> at
> org.apache.sshd.client.subsystem.sftp.SftpFileSystemProvider.newFileSystem(SftpFileSystemProvider.java:87)
> at java.nio.file.FileSystems.newFileSystem(FileSystems.java:322)
> at java.nio.file.FileSystems.newFileSystem(FileSystems.java:272)
> at
> org.apache.sshd.client.subsystem.sftp.SftpFileSystemTest.testAttributes(SftpFileSystemTest.java:136)
> ---
> While ssh code enforces only world/group writeable at
> readconf.c::read_config_file:
> ---
> if (flags & SSHCONF_CHECKPERM) {
> struct stat sb;
> if (fstat(fileno(f), &sb) == -1)
> fatal("fstat %s: %s", filename, strerror(errno));
> if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
> (sb.st_mode & 022) != 0))
> fatal("Bad owner or permissions on %s", filename);
> }
> ---
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
