Skip to content

Ensuring ssh key.pub is set to default perms

Alexander Strachan requested to merge astrachan-master-patch-75257 into master

What does this MR do?

During a customer support is was noted that following https://docs.gitlab.com/ee/administration/geo/replication/configuration.html#step-2-manually-replicate-the-primary-sites-ssh-host-keys will change the default permissions of the ssh public keys from 0644 -> 0600

This MR is to ensure that these are kept at the default permission.

Example (default permissions)

# ls -l /etc/ssh/ssh_host_*_key*
-rw------- 1 root root 1393 Mar  9 08:46 /etc/ssh/ssh_host_dsa_key
-rw-r--r-- 1 root root  612 Mar  9 08:46 /etc/ssh/ssh_host_dsa_key.pub
-rw------- 1 root root  513 Mar  9 08:46 /etc/ssh/ssh_host_ecdsa_key
-rw-r--r-- 1 root root  184 Mar  9 08:46 /etc/ssh/ssh_host_ecdsa_key.pub
-rw------- 1 root root  419 Mar  9 08:46 /etc/ssh/ssh_host_ed25519_key
-rw-r--r-- 1 root root  104 Mar  9 08:46 /etc/ssh/ssh_host_ed25519_key.pub
-rw------- 1 root root 2610 Mar  9 08:46 /etc/ssh/ssh_host_rsa_key
-rw-r--r-- 1 root root  576 Mar  9 08:46 /etc/ssh/ssh_host_rsa_key.pub

Related issues

Customer ZD - internal link only.

Author's checklist

If you are a GitLab team member and only adding documentation, do not add any of the following labels:

  • ~"frontend"
  • ~"backend"
  • ~"type::bug"
  • ~"database"

These labels cause the MR to be added to code verification QA issues.

Reviewer's checklist

Documentation-related MRs should be reviewed by a Technical Writer for a non-blocking review, based on Documentation Guidelines and the Style Guide.

  • If the content requires it, ensure the information is reviewed by a subject matter expert.
  • Technical writer review items:
    • Ensure docs metadata is present and up-to-date.
    • Ensure the appropriate labels are added to this MR.
    • Ensure a release milestone is set.
    • If relevant to this MR, ensure content topic type principles are in use, including:
      • The headings should be something you'd do a Google search for. Instead of Default behavior, say something like Default behavior when you close an issue.
      • The headings (other than the page title) should be active. Instead of Configuring GDK, say something like Configure GDK.
      • Any task steps should be written as a numbered list.
      • If the content still needs to be edited for topic types, you can create a follow-up issue with the docs-technical-debt label.
  • Review by assigned maintainer, who can always request/require the reviews above. Maintainer's review can occur before or after a technical writer review.
Edited by Alexander Strachan

Merge request reports

Loading