Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix folder permissions for programdata\ssh during server install #549

Merged
merged 12 commits into from
Feb 5, 2022
Merged

fix folder permissions for programdata\ssh during server install #549

Changes from 2 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
156d804
fix folder permissions for programdata\ssh during server install
tgauth Dec 20, 2021
a547d1a
modify file restrictions for private key files and log folder/files s…
tgauth Jan 3, 2022
8a87bb6
use utils to validate and fix ssh folder file permissions
tgauth Jan 4, 2022
a260160
modify checks on log folder and files
tgauth Jan 5, 2022
8469b45
add readandexecute permission checking and encapsulate into repair-ss…
tgauth Feb 1, 2022
3cb223a
debug message for appveyor
tgauth Feb 1, 2022
211e3d1
permit log files to have system or admin as the owner
tgauth Feb 2, 2022
fe32922
allow system or admin to be file owner, and allow read or read&execut…
tgauth Feb 3, 2022
b53488b
remove debug statement
tgauth Feb 3, 2022
155df3d
permit log folder to have read access for authenticated users
tgauth Feb 4, 2022
4b8641f
rename ReadAndExecute parameter for @paras logic
tgauth Feb 4, 2022
c866985
consolidate log folder logic
tgauth Feb 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions contrib/win32/openssh/install-sshd.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
# @friism - Fixed issue with invalid SDDL on Set-Acl
# @manojampalam - removed ntrights.exe dependency
# @bingbing8 - removed secedit.exe dependency
# @tessgauthier - added permissions check for %programData%/ssh

$ErrorActionPreference = 'Stop'

Expand Down Expand Up @@ -84,6 +85,26 @@ if (Test-Path $moduliPath -PathType Leaf)
Repair-ModuliFilePermission -FilePath $moduliPath @psBoundParameters -confirm:$false
}

#If %programData%/ssh folder already exists, fix permissions
$sshProgDataPath = Join-Path $env:ProgramData "ssh"
tgauth marked this conversation as resolved.
Show resolved Hide resolved
if (Test-Path $sshProgDataPath)
{
$sshProgDataAcl=Get-Acl $sshProgDataPath
# Folder permission is FullAccess to System and Builtin/Admins and read only access to Authenticated users
$sshProgDataAcl.SetSecurityDescriptorSddlForm("O:BAD:PAI(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;AU)")
Set-Acl $sshProgDataPath $sshProgDataAcl
# private key files and log folder/files should only allow FullAccess to System and Builtin/Admins
$restricted_files = @("ssh_host_dsa_key", "ssh_host_ecdsa_key", "ssh_host_ed25519_key", "ssh_host_rsa_key")
$sshProgDataAcl.SetSecurityDescriptorSddlForm("O:BAD:PAI(A;;FA;;;SY)(A;;FA;;;BA)")
Get-ChildItem -Path (Join-Path $sshProgDataPath '*') -Recurse -Include $restricted_files -Force | Set-Acl -AclObject $sshProgDataAcl
$sshProgDataAcl.SetSecurityDescriptorSddlForm("O:BAD:PAI(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)")
tgauth marked this conversation as resolved.
Show resolved Hide resolved
$log_folder = Join-Path $sshProgDataPath "logs"
if (Test-Path $log_folder)
{
Set-Acl $log_folder $sshProgDataAcl
}
}

#register etw provider
wevtutil im `"$etwman`"

Expand Down