1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2024-09-14 20:13:21 +02:00

Error if private_key_file is group/world readable

Currently, if you have this, ansible fails with a generic error and
suggests running again with `-vvvv`. This isn't bad but pinpointing the
specific problem immediately is even more user-friendly.

```
$ ls -l devops.pem
-rw-r--r--+ 1 marca  staff  1679 Jul  2 11:25 devops.pem

$ ansible -m ping --private-key=devops.pem mt3-pyweb01
mt3-pyweb01 | FAILED => private_key_file (devops.pem) is group-readable or world-readable and thus insecure - you will probably get an SSH failure
```
This commit is contained in:
Marc Abramowitz 2014-07-02 13:21:01 -07:00
parent 14cf3c4d2a
commit 5b783e0bc6

View file

@ -18,6 +18,9 @@
################################################
import os
import stat
from ansible import utils
from ansible.errors import AnsibleError
@ -31,5 +34,12 @@ class Connector(object):
conn = utils.plugins.connection_loader.get(transport, self.runner, host, port, user=user, password=password, private_key_file=private_key_file)
if conn is None:
raise AnsibleError("unsupported connection type: %s" % transport)
if private_key_file:
# If private key is readable by user other than owner, flag an error
st = os.stat(private_key_file)
if st.st_mode & (stat.S_IRGRP | stat.S_IROTH):
raise AnsibleError("private_key_file (%s) is group-readable or world-readable and thus insecure - "
"you will probably get an SSH failure"
% (private_key_file,))
self.active = conn.connect()
return self.active