CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(e2e): Ensure permissions on key file are correct (#6062)

Browse Source
This commit is contained in:
Michael Li authored and GitHub committed 2025-09-18 16:27:43 -04:00
1 parent 6f945ec27a
commit 487107e958
3 files changed
+20 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

enos/modules/aws_rdp_member_server/main.tf
+6
View File
@@ -133,10 +133,16 @@ resource "aws_instance" "member_server" {
$AuthorizedKey = (Invoke-WebRequest -Uri 'http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key' -Headers $ImdsHeaders -UseBasicParsing).Content
$AuthorizedKeysPath = 'C:\ProgramData\ssh\administrators_authorized_keys'
New-Item -Path $AuthorizedKeysPath -ItemType File -Value $AuthorizedKey -Force
# Set the correct permissions on the authorized_keys file
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /grant "Administrators:F" /grant "SYSTEM:F"
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /remove "Users"
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /remove "Authenticated Users"
# Ensure the SSH agent pulls in the new key.
Set-Service -Name ssh-agent -StartupType "Automatic"
Restart-Service -Name ssh-agent
Restart-Service -Name sshd
# Open the firewall for SSH connections
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
enos/modules/aws_rdp_member_server_with_worker/main.tf
+6
View File
@@ -158,10 +158,16 @@ resource "aws_instance" "worker" {
$AuthorizedKey = (Invoke-WebRequest -Uri 'http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key' -Headers $ImdsHeaders -UseBasicParsing).Content
$AuthorizedKeysPath = 'C:\ProgramData\ssh\administrators_authorized_keys'
New-Item -Path $AuthorizedKeysPath -ItemType File -Value $AuthorizedKey -Force
# Set the correct permissions on the authorized_keys file
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /grant "Administrators:F" /grant "SYSTEM:F"
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /remove "Users"
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /remove "Authenticated Users"
# Ensure the SSH agent pulls in the new key.
Set-Service -Name ssh-agent -StartupType "Automatic"
Restart-Service -Name ssh-agent
Restart-Service -Name sshd
# Open the firewall for SSH
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
enos/modules/aws_windows_client/main.tf
+8 -2
View File
@@ -160,8 +160,8 @@ resource "aws_instance" "client" {
# Set up SSH so we can remotely manage the instance
## Install OpenSSH Server and Client
# Loop to make sure that SSH installs correctly
$elapsed = 0
# Loop to make sure that SSH installs correctly
$elapsed = 0
do {
try {
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
@@ -215,10 +215,16 @@ resource "aws_instance" "client" {
$AuthorizedKey = (Invoke-WebRequest -Uri 'http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key' -Headers $ImdsHeaders -UseBasicParsing).Content
$AuthorizedKeysPath = 'C:\ProgramData\ssh\administrators_authorized_keys'
New-Item -Path $AuthorizedKeysPath -ItemType File -Value $AuthorizedKey -Force
# Set the correct permissions on the authorized_keys file
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /grant "Administrators:F" /grant "SYSTEM:F"
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /remove "Users"
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /remove "Authenticated Users"
## Ensure the SSH agent pulls in the new key.
Set-Service -Name ssh-agent -StartupType "Automatic"
Restart-Service -Name ssh-agent
Restart-Service -Name sshd
## Open the firewall for SSH connections
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22