Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

atlas-sw-probe: tweak SSH key permissions #24649

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

kempniu
Copy link

@kempniu kempniu commented Jul 23, 2024

Do not run chown or chgrp for probe key files since the probe scripts are run as root anyway.

Do not run chmod 644 for /etc/atlas/probe_key since an SSH private key should not be readable by any user except the owner.

Maintainer: @ja-pa
Cc: @Ansuel (author of 0afe371, see #15488)


Perhaps I am missing something obvious, but the efforts that the init script makes to chown atlas:atlas various files is puzzling to me, given that upstream scripts do not seem to be designed for running as any user other than root (there are e.g. writes to hard-coded paths that are only writable by root. (The atlas user is created by the atlas-probe package.)

In fact, if the SSH key files were owned by root in the first place, ssh itself would detect that the permissions set for them by the init script are too open. However, that check is only triggered if the user that ssh is run as is the same as the user owning the key file. (In this case, that's root vs. atlas, so the 644 mode set for the private key does not prevent ssh from working.)

This PR attempts to ensure that file modes are set identical no matter whether ssh-keygen or dropbearkey/dropbearconvert are used for generating the probe keys.

@kempniu kempniu force-pushed the atlas-sw-probe-tweak-ssh-key-permissions branch from 3242e6a to eb1e0eb Compare July 23, 2024 12:09
Do not run chown or chgrp for probe key files since the probe scripts
are run as root anyway.

Do not run chmod 644 for /etc/atlas/probe_key since an SSH private key
should not be readable by any user except the owner.

Signed-off-by: Michał Kępień <[email protected]>
@kempniu kempniu force-pushed the atlas-sw-probe-tweak-ssh-key-permissions branch from eb1e0eb to ac6234d Compare February 18, 2025 04:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant