Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ssh: add trust checks before sourcing env vars #1395

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

ssh: add trust checks before sourcing env vars #1395

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
56d0dc5
ssh: remove persistent socket; use macOS Keychain
slarew Jul 22, 2017
3f8dace
Load :prezto:module:ssh:load identities on macOS
slarew Oct 6, 2017
84ad1f3
ssh: add trust checks before sourcing env vars
slarew Jul 22, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 27 additions & 14 deletions modules/ssh/init.zsh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,26 +16,32 @@ _ssh_dir="$HOME/.ssh"
# Set the path to the environment file if not set by another module.
_ssh_agent_env="${_ssh_agent_env:-${TMPDIR:-/tmp}/ssh-agent.env.$UID}"

# Set the path to the persistent authentication socket.
_ssh_agent_sock="${TMPDIR:-/tmp}/ssh-agent.sock.$UID"
# Due to the predictability of the env file, check the env file exists and is
# owned by current EUID before trusting it.
if [[ -f "$_ssh_agent_env" && ! -O "$_ssh_agent_env" ]]; then
cat 1>&2 <<-EOF
ERROR: Cannot trust the SSH agent environment variables persistence
file because it is owned by another user.
The ssh-agent will not be started.
$_ssh_agent_env
EOF
unset _ssh_{dir,agent_env}
return 1
fi

# Start ssh-agent if not started.
# If a socket exists at SSH_AUTH_SOCK, assume ssh-agent is already running and
# skip starting it.
if [[ ! -S "$SSH_AUTH_SOCK" ]]; then
# Export environment variables.
# Try to grab previously exported environment variables.
source "$_ssh_agent_env" 2> /dev/null

# Start ssh-agent if not started.
if ! ps -U "$LOGNAME" -o pid,ucomm | grep -q -- "${SSH_AGENT_PID:--1} ssh-agent"; then
# Do not start ssh-agent if the PID from the last start of ssh-agent exists and
# corresponds to a running ssh-agent under the current user.
if ! ps -U "$LOGNAME" -o pid,comm | grep -E -q -e "^[[:blank:]]*${SSH_AGENT_PID:--1}[[:blank:]].*ssh-agent$"; then
eval "$(ssh-agent | sed '/^echo /d' | tee "$_ssh_agent_env")"
fi
fi

# Create a persistent SSH authentication socket.
if [[ -S "$SSH_AUTH_SOCK" && "$SSH_AUTH_SOCK" != "$_ssh_agent_sock" ]]; then
ln -sf "$SSH_AUTH_SOCK" "$_ssh_agent_sock"
export SSH_AUTH_SOCK="$_ssh_agent_sock"
fi

# Load identities.
if ssh-add -l 2>&1 | grep -q 'The agent has no identities'; then
zstyle -a ':prezto:module:ssh:load' identities '_ssh_identities'
Expand All @@ -50,11 +56,18 @@ if ssh-add -l 2>&1 | grep -q 'The agent has no identities'; then
# program specified by SSH_ASKPASS and open an X11 window to read the
# passphrase.
if [[ -n "$DISPLAY" && -x "$SSH_ASKPASS" ]]; then
ssh-add ${_ssh_identities:+$_ssh_dir/${^_ssh_identities[@]}} < /dev/null 2> /dev/null
ssh-add "${_ssh_identities:+$_ssh_dir/${^_ssh_identities[@]}}" < /dev/null 2> /dev/null
else
ssh-add ${_ssh_identities:+$_ssh_dir/${^_ssh_identities[@]}} 2> /dev/null
fi

if [[ "$OSTYPE" == darwin* ]]; then
# macOS: `ssh-add -A` will load all identities defined in Keychain.
# Assume `/usr/bin/ssh-add` is Apple customized version that understands
# the `-A` switch.
/usr/bin/ssh-add -A
fi
fi

# Clean up.
unset _ssh_{dir,identities} _ssh_agent_{env,sock}
unset _ssh_{dir,identities,agent_env}