[SSHD-584] Check keys and configuration files permissions as closely as possible like OpenSSH by default

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.1.0
• Fix Version/s: 1.1.0
• Environment: build
• Assignee: Unassigned
• Reporter: Alon Bar-Lev
• Created: 13/Nov/15 14:58
• Updated: 02/Dec/15 12:58
• Resolved: 22/Nov/15 06:19

Description

Got this exception:
—
testAttributes(org.apache.sshd.client.subsystem.sftp.SftpFileSystemTest) Time elapsed: 5.581 sec <<< ERROR!
java.io.IOException: String permission violation (GROUP_READ) for /home/alonbl/.ssh/config
at org.apache.sshd.client.config.hosts.DefaultConfigFileHostEntryResolver.reloadHostConfigEntries(DefaultConfigFileHostEntryResolver.java:80)
at org.apache.sshd.client.config.hosts.ConfigFileHostEntryResolver.resolveEffectiveResolver(ConfigFileHostEntryResolver.java:86)
at org.apache.sshd.client.config.hosts.ConfigFileHostEntryResolver.resolveEffectiveHost(ConfigFileHostEntryResolver.java:59)
at org.apache.sshd.client.SshClient.connect(SshClient.java:339)
at org.apache.sshd.client.subsystem.sftp.SftpFileSystemProvider.newFileSystem(SftpFileSystemProvider.java:177)
at org.apache.sshd.client.subsystem.sftp.SftpFileSystemProvider.newFileSystem(SftpFileSystemProvider.java:87)
at java.nio.file.FileSystems.newFileSystem(FileSystems.java:322)
at java.nio.file.FileSystems.newFileSystem(FileSystems.java:272)
at org.apache.sshd.client.subsystem.sftp.SftpFileSystemTest.testAttributes(SftpFileSystemTest.java:136)
—

While ssh code enforces only world/group writeable at readconf.c::read_config_file:
—
if (flags & SSHCONF_CHECKPERM)

{ struct stat sb; if (fstat(fileno(f), &sb) == -1) fatal("fstat %s: %s", filename, strerror(errno)); if (((sb.st_uid != 0 && sb.st_uid != getuid()) || (sb.st_mode & 022) != 0)) fatal("Bad owner or permissions on %s", filename); }

—

Issue Links

• relates to: SSHD-606 Windows strict permissions key file check always fails due to owner mismatch