only remove authenticated users access to ssh keys if they have permissions
@@ -56,10 +56,10 @@ pub async fn add_ssh_key(key_info: SshKeyInfo) -> Result<()> {
match SET_PERMISSION_ONCE.set(()) {
Ok(_) => {
debug!("removing Authenticated Users permissions from administrators_authorized_keys");
+
+ let admins = "NT AUTHORITY\\Authenticated Users";
let result = Command::new("icacls.exe")
.arg(&admin_auth_keys_path)
- .arg("/remove")
- .arg("NT AUTHORITY/Authenticated Users")
.stdin(Stdio::null())
.stdout(Stdio::piped())
.stderr(Stdio::piped())
@@ -70,12 +70,37 @@ pub async fn add_ssh_key(key_info: SshKeyInfo) -> Result<()> {
.context("icalcs failed to run")?;
if !result.status.success() {
bail!(
- "removing 'NT AUTHORITY/Authenticated Users' permissions to '{}' failed: {:?}",
+ "checking permissions failed: '{}' failed: {:?}",
admin_auth_keys_path.display(),
result
);
}
+ let stdout = String::from_utf8_lossy(&result.stdout).to_string();
+
+ if stdout.contains(&admins) {
+ let result = Command::new("icacls.exe")
+ .arg(&admin_auth_keys_path)
+ .arg("/remove")
+ .arg(&admins)
+ .stdin(Stdio::null())
+ .stdout(Stdio::piped())
+ .stderr(Stdio::piped())
+ .spawn()
+ .context("icacls remove failed to start")?
+ .wait_with_output()
+ .await
+ .context("icalcs remove failed to run")?;
+ if !result.status.success() {
+ warn!(
+ "removing {:?} permissions to '{}' failed: {:?}",
+ admins,
+ admin_auth_keys_path.display(),
+ result
+ );
+ }
+ }
+
debug!("removing inheritance");
let result = Command::new("icacls.exe")
.arg(&admin_auth_keys_path)
