Skip to content

Commit

Permalink
allow-ssh.inc: allow /etc/ssh/ssh_config
Browse files Browse the repository at this point in the history
This is the system-wide equivalent of ~/.ssh/config.

    $ pacman -Q openssh
    openssh 8.4p1-2

Reasons for blacklisting both /etc/ssh and /etc/ssh/* on
disable-common.inc:

Leave /etc/ssh that way so that profiles without allow-ssh.inc remain
unable to see inside of /etc/ssh.  And blacklist /etc/ssh/* so that
profiles with allow-ssh.inc are able to access only nonblacklisted files
inside of /etc/ssh.
  • Loading branch information
kmk3 committed Jan 27, 2021
1 parent 83ac023 commit 3849e12
Show file tree
Hide file tree
Showing 4 changed files with 5 additions and 2 deletions.
2 changes: 2 additions & 0 deletions etc/inc/allow-ssh.inc
Original file line number Diff line number Diff line change
Expand Up @@ -3,3 +3,5 @@
include allow-ssh.local

noblacklist ${HOME}/.ssh
noblacklist /etc/ssh
noblacklist /etc/ssh/ssh_config
1 change: 1 addition & 0 deletions etc/inc/disable-common.inc
Original file line number Diff line number Diff line change
Expand Up @@ -396,6 +396,7 @@ blacklist /etc/shadow
blacklist /etc/shadow+
blacklist /etc/shadow-
blacklist /etc/ssh
blacklist /etc/ssh/*
blacklist /home/.ecryptfs
blacklist /home/.fscrypt
blacklist /var/backup
Expand Down
2 changes: 1 addition & 1 deletion etc/profile-m-z/ssh-agent.profile
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ include ssh-agent.local
# Persistent global definitions
include globals.local

noblacklist /etc/ssh
noblacklist /etc/ssh/*
noblacklist /tmp/ssh-*

# Allow ssh (blacklisted by disable-common.inc)
Expand Down
2 changes: 1 addition & 1 deletion etc/profile-m-z/ssh.profile
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ include ssh.local
# Persistent global definitions
include globals.local

noblacklist /etc/ssh
noblacklist /etc/ssh/*
noblacklist /tmp/ssh-*
# nc can be used as ProxyCommand, e.g. when using tor
noblacklist ${PATH}/nc
Expand Down

0 comments on commit 3849e12

Please sign in to comment.