authorized_keys can be changed by user

[antoinedeschenes]

Hi, is it the intended behavior to let the user upload a new authorized_keys file under it's home folder?

Read-write permissions are set on the file. https://github.com/emberstack/docker-sftp/blob/master/src/ES.SFTP.Host/Orchestrator.cs#L419

Thanks!

https://github.com/emberstack/docker-sftp/pull/13

[winromulus]

Hi @antoinedeschenes . I need to look into this. Normally it should be read-only.

[winromulus]

@antoinedeschenes can you join our Slack? I need to run some question by you for the read-only, especially if you use SSH keys for login. You might have a better testing environment than me. (Slack: https://join.slack.com/t/emberstack/shared_invite/zt-8qyutopg-9ghwTq3OnHSm2tY9Sk5ULA )

[antoinedeschenes]

Hi @winromulus, I'll get back to you later if you need, I basically used the docker-compose example included in the repo.

If the authorized_keys is created on startup, it'll have 'rw' permissions and the user can overwrite the file:

src/deploy/docker-compose$ docker-compose -f docker-compose.override.dev.yaml up 
src/deploy/samples/.ssh$ chmod 0600 id_demo_rsa
src/deploy/samples/.ssh$ sftp -o IdentitiesOnly=yes -P 2222 -i id_demo_rsa demo@localhost
sftp> cd ../.ssh
sftp> put id_demo2_rsa.pub authorized_keys

Here's the permission fix:https://github.com/emberstack/docker-sftp/pull/13

[nvanheuverzwijn]

@winromulus Would love to get this fixed !

[winromulus]

Fixed with PR from @antoinedeschenes Thank you for your contribution!