tyler.durden/Win32-OpenSSH
1
0
Fork 0
mirror of https://github.com/PowerShell/Win32-OpenSSH.git synced 2025-07-28 16:34:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

Updated Security protection of various files in Win32 OpenSSH (markdown)

Manoj Ampalam 2017-05-14 23:20:28 -07:00
parent 0bd54d94b5
commit a215883b4a
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
Security-protection-of-various-files-in-Win32-OpenSSH.md

@ -3,9 +3,9 @@
Starting with the release of [v0.0.13.0][build13], Win32-OpenSSH ensures any configuration and key files are secure before they are loaded.
Specifically, following permission checks are enforced:
- User specific resources on client side -
- User's private keys should not be accessible to other users.
- User's ssh_config (%userprofile%\.ssh\config) should not be accessible to other users.
- User specific resources on client side - private keys and ssh_config ((%userprofile%\.ssh\config)
- Should not be accessible to other (non-admin) users.
- Should not be owned by any other (non-admin) user.
- Ex. ssh would fail to use the following private key for userA, since "someotheruser" also has access.
```
c:\>icacls userkey
@ -13,7 +13,8 @@ userkey userA(F)
someotheruser(R)
```
- User specific resources on server side - authorized_keys
- Should not be accessible to other users.
- Should not be accessible to other (non-admin) users.
- Should not be owned by any other (non-admin) user.
- "NT Service/sshd" can only have (R) access.
- Ex. sshd would not respect the following authorized_keys for userA, since "someotheruser" also has access.
```
@ -23,8 +24,8 @@ authorized_keys NT SERVICE\sshd:(R)
someotheruser(R)
```
- Host specific resources on server side - host private keys
- Should not be owned by a non-admin user
- Should not be accessible to any non-admin user
- Should not be owned by a non-admin user
- "NT Service/sshd" can only have (R) access.
- Ex. sshd would not respect the following host key, since "nonadmin" has access.
```