2017-06-27 06:58:29 +02:00
|
|
|
|
Import-Module OpenSSHUtils -Force
|
|
|
|
|
|
|
|
|
|
Add-Type -TypeDefinition @"
|
|
|
|
|
public enum PlatformType
|
|
|
|
|
{
|
|
|
|
|
Windows,
|
|
|
|
|
Linux,
|
|
|
|
|
OSX
|
|
|
|
|
}
|
|
|
|
|
"@
|
file permission on ssh_config, authorized_keys, private keys, host keys, public keys. (#110)
1. Add file permission check when load or add ssh_config, authorized_keys, private keys, host keys,.
2. set the owner and ACE for create secure file, ex, private key in ssh-keygen.exe
3. Update script OpenSSHTestHelper.psm1 to be able to run Install-OpenSSH if the sshd is running on the machine.
4. add OpenSSHBinPath to path.
5. change indents in agentconfig.c
6. update test script to represent the changes
7. Add tests for:
* authorized_keys and ssh-keygen testing
* host keys file perm testing
* user private key file perm testing
* ssh-add test
* user ssh_config
2017-05-01 23:18:20 +02:00
|
|
|
|
|
|
|
|
|
function Get-Platform {
|
|
|
|
|
# Use the .NET Core APIs to determine the current platform; if a runtime
|
|
|
|
|
# exception is thrown, we are on FullCLR, not .NET Core.
|
|
|
|
|
try {
|
|
|
|
|
$Runtime = [System.Runtime.InteropServices.RuntimeInformation]
|
|
|
|
|
$OSPlatform = [System.Runtime.InteropServices.OSPlatform]
|
|
|
|
|
|
|
|
|
|
$IsLinux = $Runtime::IsOSPlatform($OSPlatform::Linux)
|
|
|
|
|
$IsOSX = $Runtime::IsOSPlatform($OSPlatform::OSX)
|
|
|
|
|
$IsWindows = $Runtime::IsOSPlatform($OSPlatform::Windows)
|
|
|
|
|
} catch {
|
|
|
|
|
try {
|
|
|
|
|
$IsLinux = $false
|
|
|
|
|
$IsOSX = $false
|
|
|
|
|
$IsWindows = $true
|
|
|
|
|
}
|
|
|
|
|
catch { }
|
|
|
|
|
}
|
|
|
|
|
if($IsOSX) {
|
|
|
|
|
[PlatformType]::OSX
|
|
|
|
|
} elseif($IsLinux) {
|
|
|
|
|
[PlatformType]::Linux
|
|
|
|
|
} else {
|
|
|
|
|
[PlatformType]::Windows
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2017-06-27 06:58:29 +02:00
|
|
|
|
function Set-FilePermission
|
file permission on ssh_config, authorized_keys, private keys, host keys, public keys. (#110)
1. Add file permission check when load or add ssh_config, authorized_keys, private keys, host keys,.
2. set the owner and ACE for create secure file, ex, private key in ssh-keygen.exe
3. Update script OpenSSHTestHelper.psm1 to be able to run Install-OpenSSH if the sshd is running on the machine.
4. add OpenSSHBinPath to path.
5. change indents in agentconfig.c
6. update test script to represent the changes
7. Add tests for:
* authorized_keys and ssh-keygen testing
* host keys file perm testing
* user private key file perm testing
* ssh-add test
* user ssh_config
2017-05-01 23:18:20 +02:00
|
|
|
|
{
|
|
|
|
|
param(
|
2017-05-24 06:45:38 +02:00
|
|
|
|
[parameter(Mandatory=$true)]
|
file permission on ssh_config, authorized_keys, private keys, host keys, public keys. (#110)
1. Add file permission check when load or add ssh_config, authorized_keys, private keys, host keys,.
2. set the owner and ACE for create secure file, ex, private key in ssh-keygen.exe
3. Update script OpenSSHTestHelper.psm1 to be able to run Install-OpenSSH if the sshd is running on the machine.
4. add OpenSSHBinPath to path.
5. change indents in agentconfig.c
6. update test script to represent the changes
7. Add tests for:
* authorized_keys and ssh-keygen testing
* host keys file perm testing
* user private key file perm testing
* ssh-add test
* user ssh_config
2017-05-01 23:18:20 +02:00
|
|
|
|
[string]$FilePath,
|
2017-06-27 06:58:29 +02:00
|
|
|
|
[parameter(Mandatory=$true)]
|
|
|
|
|
[System.Security.Principal.SecurityIdentifier] $UserSid,
|
2017-05-24 06:45:38 +02:00
|
|
|
|
[System.Security.AccessControl.FileSystemRights[]]$Perms,
|
2017-06-27 06:58:29 +02:00
|
|
|
|
[System.Security.AccessControl.AccessControlType] $AccessType = "Allow",
|
|
|
|
|
[ValidateSet("Add", "Delete")]
|
|
|
|
|
[string]$Action = "Add"
|
file permission on ssh_config, authorized_keys, private keys, host keys, public keys. (#110)
1. Add file permission check when load or add ssh_config, authorized_keys, private keys, host keys,.
2. set the owner and ACE for create secure file, ex, private key in ssh-keygen.exe
3. Update script OpenSSHTestHelper.psm1 to be able to run Install-OpenSSH if the sshd is running on the machine.
4. add OpenSSHBinPath to path.
5. change indents in agentconfig.c
6. update test script to represent the changes
7. Add tests for:
* authorized_keys and ssh-keygen testing
* host keys file perm testing
* user private key file perm testing
* ssh-add test
* user ssh_config
2017-05-01 23:18:20 +02:00
|
|
|
|
)
|
|
|
|
|
|
2017-05-24 06:45:38 +02:00
|
|
|
|
$myACL = Get-ACL $FilePath
|
2017-06-27 06:58:29 +02:00
|
|
|
|
$account = Get-UserAccount -UserSid $UserSid
|
|
|
|
|
if($Action -ieq "Delete")
|
|
|
|
|
{
|
|
|
|
|
$myACL.SetAccessRuleProtection($True, $True)
|
|
|
|
|
Enable-Privilege SeRestorePrivilege | out-null
|
|
|
|
|
Set-Acl -Path $FilePath -AclObject $myACL
|
|
|
|
|
$myACL = Get-ACL $FilePath
|
|
|
|
|
|
|
|
|
|
if($myACL.Access)
|
|
|
|
|
{
|
|
|
|
|
$myACL.Access | % {
|
|
|
|
|
if($_.IdentityReference.Equals($account))
|
|
|
|
|
{
|
|
|
|
|
if($_.IsInherited)
|
|
|
|
|
{
|
|
|
|
|
$myACL.SetAccessRuleProtection($True, $True)
|
|
|
|
|
Enable-Privilege SeRestorePrivilege | out-null
|
|
|
|
|
Set-Acl -Path $FilePath -AclObject $myACL
|
|
|
|
|
$myACL = Get-ACL $FilePath
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if(-not ($myACL.RemoveAccessRule($_)))
|
|
|
|
|
{
|
|
|
|
|
throw "failed to remove access of $($_.IdentityReference) rule in setup "
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
elseif($Perms)
|
2017-05-24 06:45:38 +02:00
|
|
|
|
{
|
|
|
|
|
$Perms | % {
|
|
|
|
|
$userACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
|
2017-06-27 06:58:29 +02:00
|
|
|
|
($UserSid, $_, "None", "None", $AccessType)
|
2017-05-24 06:45:38 +02:00
|
|
|
|
$myACL.AddAccessRule($userACE)
|
|
|
|
|
}
|
2017-06-27 06:58:29 +02:00
|
|
|
|
}
|
|
|
|
|
Enable-Privilege SeRestorePrivilege | out-null
|
|
|
|
|
Set-Acl -Path $FilePath -AclObject $myACL -confirm:$false
|
file permission on ssh_config, authorized_keys, private keys, host keys, public keys. (#110)
1. Add file permission check when load or add ssh_config, authorized_keys, private keys, host keys,.
2. set the owner and ACE for create secure file, ex, private key in ssh-keygen.exe
3. Update script OpenSSHTestHelper.psm1 to be able to run Install-OpenSSH if the sshd is running on the machine.
4. add OpenSSHBinPath to path.
5. change indents in agentconfig.c
6. update test script to represent the changes
7. Add tests for:
* authorized_keys and ssh-keygen testing
* host keys file perm testing
* user private key file perm testing
* ssh-add test
* user ssh_config
2017-05-01 23:18:20 +02:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function Add-PasswordSetting
|
|
|
|
|
{
|
|
|
|
|
param([string] $pass)
|
|
|
|
|
$platform = Get-Platform
|
|
|
|
|
if ($platform -eq [PlatformType]::Windows) {
|
|
|
|
|
if (-not($env:DISPLAY)) {$env:DISPLAY = 1}
|
2019-09-13 23:13:42 +02:00
|
|
|
|
$askpass_util = Join-Path $PSScriptRoot "utilities\askpass_util\askpass_util.exe"
|
|
|
|
|
$env:SSH_ASKPASS=$askpass_util
|
|
|
|
|
$env:ASKPASS_PASSWORD=$pass
|
file permission on ssh_config, authorized_keys, private keys, host keys, public keys. (#110)
1. Add file permission check when load or add ssh_config, authorized_keys, private keys, host keys,.
2. set the owner and ACE for create secure file, ex, private key in ssh-keygen.exe
3. Update script OpenSSHTestHelper.psm1 to be able to run Install-OpenSSH if the sshd is running on the machine.
4. add OpenSSHBinPath to path.
5. change indents in agentconfig.c
6. update test script to represent the changes
7. Add tests for:
* authorized_keys and ssh-keygen testing
* host keys file perm testing
* user private key file perm testing
* ssh-add test
* user ssh_config
2017-05-01 23:18:20 +02:00
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function Remove-PasswordSetting
|
|
|
|
|
{
|
|
|
|
|
if ($env:DISPLAY -eq 1) { Remove-Item env:\DISPLAY }
|
|
|
|
|
Remove-item "env:SSH_ASKPASS" -ErrorAction SilentlyContinue
|
2019-09-13 23:13:42 +02:00
|
|
|
|
Remove-item "env:ASKPASS_PASSWORD" -ErrorAction SilentlyContinue
|
2018-01-29 22:49:01 +01:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
$Taskfolder = "\OpenSSHTestTasks\"
|
|
|
|
|
$Taskname = "StartTestDaemon"
|
|
|
|
|
|
|
|
|
|
function Start-SSHDTestDaemon
|
|
|
|
|
{
|
|
|
|
|
param(
|
|
|
|
|
[string] $Arguments,
|
2019-06-18 07:46:33 +02:00
|
|
|
|
[string] $Workdir,
|
|
|
|
|
[string] $Port)
|
2018-01-29 22:49:01 +01:00
|
|
|
|
|
2019-06-18 07:46:33 +02:00
|
|
|
|
$Arguments += " -p $Port"
|
2018-01-29 22:49:01 +01:00
|
|
|
|
$ac = New-ScheduledTaskAction -Execute (join-path $workdir "sshd") -WorkingDirectory $workdir -Argument $Arguments
|
|
|
|
|
$task = Register-ScheduledTask -TaskName $Taskname -User system -Action $ac -TaskPath $Taskfolder -Force
|
|
|
|
|
Start-ScheduledTask -TaskPath $Taskfolder -TaskName $Taskname
|
|
|
|
|
#sleep for 1 seconds for process to ready to listener
|
|
|
|
|
$num = 0
|
2019-06-18 07:46:33 +02:00
|
|
|
|
while ((netstat -anop TCP | select-string -Pattern "0.0.0.0:$Port") -eq $null)
|
2018-01-29 22:49:01 +01:00
|
|
|
|
{
|
|
|
|
|
start-sleep 1
|
|
|
|
|
$num++
|
|
|
|
|
if($num -gt 30) { break }
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function Stop-SSHDTestDaemon
|
|
|
|
|
{
|
2019-06-18 07:46:33 +02:00
|
|
|
|
param(
|
|
|
|
|
[string] $Port)
|
|
|
|
|
|
2018-01-29 22:49:01 +01:00
|
|
|
|
$task = Get-ScheduledTask -TaskPath $Taskfolder -TaskName $Taskname -ErrorAction SilentlyContinue
|
|
|
|
|
if($task)
|
|
|
|
|
{
|
|
|
|
|
if($task.State -eq "Running")
|
|
|
|
|
{
|
|
|
|
|
Stop-ScheduledTask -TaskPath $Taskfolder -TaskName $Taskname
|
|
|
|
|
}
|
|
|
|
|
Unregister-ScheduledTask -TaskPath $Taskfolder -TaskName $Taskname -Confirm:$false
|
|
|
|
|
}
|
2019-06-18 07:46:33 +02:00
|
|
|
|
|
|
|
|
|
#kill process listening on $Port
|
|
|
|
|
$p = netstat -anop TCP | select-string -Pattern "0.0.0.0:$Port"
|
|
|
|
|
if (-not($p -eq $null))
|
2018-01-29 22:49:01 +01:00
|
|
|
|
{
|
2019-06-18 07:46:33 +02:00
|
|
|
|
foreach ($ps in $p) {
|
|
|
|
|
$pss =$ps.ToString() -split "\s+";
|
|
|
|
|
$pid = $pss[$pss.length -1]
|
|
|
|
|
Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue
|
|
|
|
|
}
|
|
|
|
|
#if still running, wait a little while for task to complete
|
|
|
|
|
$num = 0
|
|
|
|
|
while (-not((netstat -anop TCP | select-string -Pattern "0.0.0.0:$Port") -eq $null))
|
|
|
|
|
{
|
|
|
|
|
start-sleep 1
|
|
|
|
|
$num++
|
|
|
|
|
if($num -gt 30) { break }
|
|
|
|
|
}
|
2018-01-29 22:49:01 +01:00
|
|
|
|
}
|
2019-06-18 07:46:33 +02:00
|
|
|
|
|
file permission on ssh_config, authorized_keys, private keys, host keys, public keys. (#110)
1. Add file permission check when load or add ssh_config, authorized_keys, private keys, host keys,.
2. set the owner and ACE for create secure file, ex, private key in ssh-keygen.exe
3. Update script OpenSSHTestHelper.psm1 to be able to run Install-OpenSSH if the sshd is running on the machine.
4. add OpenSSHBinPath to path.
5. change indents in agentconfig.c
6. update test script to represent the changes
7. Add tests for:
* authorized_keys and ssh-keygen testing
* host keys file perm testing
* user private key file perm testing
* ssh-add test
* user ssh_config
2017-05-01 23:18:20 +02:00
|
|
|
|
}
|