4 ms·

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

by bcoates 14y ago

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Permissions 0440 for './id_rsa' are too open. It is recommended that your private key files are NOT accessible by others. This private key will be ignored. What they think they know about the user and group setup on my machine doesn't give me a lot of confidence in whatever other unsupported assumptions the software probably makes. (and despite saying "recommended" there's no override) edit: to be clear, this is SSH's "shitdick excuse" not Heroku's.

byroot 14y ago
Isn't this a warning from ssh not heroku ?
- ortuna 14y ago
  It is from SSH indeed.
- ldh 14y ago
  Sibling responses are addressing the general phenomenon in software.
seryl 14y ago
chmod 0600 ./id_rsa
- bcoates 14y ago
  If the file really was already in the badguys group and 0440 it's already been compromised so that's just covering it up. I suppose if SSH really had the courage of its convictions it'd automatically upload the key fingerprint to some revoked key blacklist.
  - car54whereareu 14y ago
    blacklist the way sudo does http://xkcd.com/838/ http://xkcd.com/838/
    - vacri 14y ago
      on a fresh debian install, the first user (me) wasn't in the sudoers list. I sudo'd, and got reported. The report mail went to root, which was cloned to the first user...
  - acdha 14y ago
    You have the ordering backwards: SSH complains now so the problem is fixed before someone gets limited access to the computer. If your account or computer has already been compromised you're still screwed but this helps considerably on shared computers, NFS, etc. where the access situation is easier to misunderstand.
rosser 14y ago
Maybe I'm weird, but I personally appreciate software that is fundamental to the security of my computing environment being a little paranoid...
xot 14y ago
Actually, StrictHostKeyChecking=no overrides it, right? and you can stuff that into your ssh config file, if you prefer that over a chmod
- bcoates 14y ago
  Doesn't in my version. looks like the behavior is in key_perm_ok in authfile.c and not configurable at all.
- ams6110 14y ago
  No that controls whether you will be allowed to connect to a host when the host key is not the same as the one previously used (mitm detection).

by bcoates 14y ago

byroot 14y ago

Isn't this a warning from ssh not heroku ?

ortuna 14y ago
It is from SSH indeed.
ldh 14y ago
Sibling responses are addressing the general phenomenon in software.

seryl 14y ago

chmod 0600 ./id_rsa

bcoates 14y ago
If the file really was already in the badguys group and 0440 it's already been compromised so that's just covering it up. I suppose if SSH really had the courage of its convictions it'd automatically upload the key fingerprint to some revoked key blacklist.
- car54whereareu 14y ago
  blacklist the way sudo does http://xkcd.com/838/ http://xkcd.com/838/
  - vacri 14y ago
    on a fresh debian install, the first user (me) wasn't in the sudoers list. I sudo'd, and got reported. The report mail went to root, which was cloned to the first user...
- acdha 14y ago
  You have the ordering backwards: SSH complains now so the problem is fixed before someone gets limited access to the computer. If your account or computer has already been compromised you're still screwed but this helps considerably on shared computers, NFS, etc. where the access situation is easier to misunderstand.

rosser 14y ago

Maybe I'm weird, but I personally appreciate software that is fundamental to the security of my computing environment being a little paranoid...

xot 14y ago

Actually, StrictHostKeyChecking=no overrides it, right? and you can stuff that into your ssh config file, if you prefer that over a chmod

bcoates 14y ago
Doesn't in my version. looks like the behavior is in key_perm_ok in authfile.c and not configurable at all.
ams6110 14y ago
No that controls whether you will be allowed to connect to a host when the host key is not the same as the one previously used (mitm detection).