mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-06-27 10:40:22 -07:00
Error if private_key_file is group/world readable
Currently, if you have this, ansible fails with a generic error and suggests running again with `-vvvv`. This isn't bad but pinpointing the specific problem immediately is even more user-friendly. ``` $ ls -l devops.pem -rw-r--r--+ 1 marca staff 1679 Jul 2 11:25 devops.pem $ ansible -m ping --private-key=devops.pem mt3-pyweb01 mt3-pyweb01 | FAILED => private_key_file (devops.pem) is group-readable or world-readable and thus insecure - you will probably get an SSH failure ```
This commit is contained in:
parent
14cf3c4d2a
commit
5b783e0bc6
1 changed files with 10 additions and 0 deletions
|
@ -18,6 +18,9 @@
|
||||||
|
|
||||||
################################################
|
################################################
|
||||||
|
|
||||||
|
import os
|
||||||
|
import stat
|
||||||
|
|
||||||
from ansible import utils
|
from ansible import utils
|
||||||
from ansible.errors import AnsibleError
|
from ansible.errors import AnsibleError
|
||||||
|
|
||||||
|
@ -31,5 +34,12 @@ class Connector(object):
|
||||||
conn = utils.plugins.connection_loader.get(transport, self.runner, host, port, user=user, password=password, private_key_file=private_key_file)
|
conn = utils.plugins.connection_loader.get(transport, self.runner, host, port, user=user, password=password, private_key_file=private_key_file)
|
||||||
if conn is None:
|
if conn is None:
|
||||||
raise AnsibleError("unsupported connection type: %s" % transport)
|
raise AnsibleError("unsupported connection type: %s" % transport)
|
||||||
|
if private_key_file:
|
||||||
|
# If private key is readable by user other than owner, flag an error
|
||||||
|
st = os.stat(private_key_file)
|
||||||
|
if st.st_mode & (stat.S_IRGRP | stat.S_IROTH):
|
||||||
|
raise AnsibleError("private_key_file (%s) is group-readable or world-readable and thus insecure - "
|
||||||
|
"you will probably get an SSH failure"
|
||||||
|
% (private_key_file,))
|
||||||
self.active = conn.connect()
|
self.active = conn.connect()
|
||||||
return self.active
|
return self.active
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue