Page MenuHomePhabricator
Create Task
Maniphest T9560

dirname(phabricator-ssh-hook.sh) needs to be owned by root too
Closed, ResolvedPublic
Actions

Description

Looks like open-ssh requires the directory phabricator-ssh-hook.sh is in to be owned by root as well as the file itself, and we don't explicitly say so in the instructions.

(At least on OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013)

Revisions and Commits

Restricted Differential RevisionRestricted Diffusion Commit

Related Objects

Event Timeline

avivey created this task.Oct 13 2015, 7:00 PM
avivey updated the task description. (Show Details)
avivey added projects: Documentation, Diffusion.
avivey added a subscriber: avivey.
joshuaspence added a subscriber: joshuaspence.Oct 14 2015, 8:30 AM
avivey added a comment.Jan 30 2016, 11:23 PM

(This is the 3rd time this came up in IRC). Looks like people are trying to keep phabricator-ssh-hook.sh close to the phabricator code.

storrgie added a subscriber: storrgie.Jan 30 2016, 11:35 PM

Thanks for this, just got caught by it myself.

epriestley mentioned this in T5463: Could not stat AuthorizedKeysCommand .Apr 25 2016, 12:28 PM
epriestley claimed this task.Apr 25 2016, 12:32 PM
epriestley added a revision: Restricted Differential Revision.Apr 25 2016, 12:40 PM
epriestley added a comment.Apr 25 2016, 12:42 PM

This also reproduced locally for me (OS X Yosemite, openssh-6.7p1), and chmod on the parent directory alone was reliably sufficient to prevent SSH from working. The instructions already suggest a root-owned location, but D15794 notes this requirement explicitly.

epriestley closed this task as Resolved by committing Restricted Diffusion Commit.Apr 25 2016, 3:16 PM
epriestley added a commit: Restricted Diffusion Commit.
cspeckmim mentioned this in Z1336: General Chat.May 25 2017, 7:56 PM
Phabricator · Built by Phacility