From 487107e958a86a2432cffc3cd183826878b7fa45 Mon Sep 17 00:00:00 2001 From: Michael Li Date: Thu, 18 Sep 2025 16:27:43 -0400 Subject: [PATCH] chore(e2e): Ensure permissions on key file are correct (#6062) --- enos/modules/aws_rdp_member_server/main.tf | 6 ++++++ enos/modules/aws_rdp_member_server_with_worker/main.tf | 6 ++++++ enos/modules/aws_windows_client/main.tf | 10 ++++++++-- 3 files changed, 20 insertions(+), 2 deletions(-) diff --git a/enos/modules/aws_rdp_member_server/main.tf b/enos/modules/aws_rdp_member_server/main.tf index f0278e0a88..86b5ba6878 100644 --- a/enos/modules/aws_rdp_member_server/main.tf +++ b/enos/modules/aws_rdp_member_server/main.tf @@ -133,10 +133,16 @@ resource "aws_instance" "member_server" { $AuthorizedKey = (Invoke-WebRequest -Uri 'http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key' -Headers $ImdsHeaders -UseBasicParsing).Content $AuthorizedKeysPath = 'C:\ProgramData\ssh\administrators_authorized_keys' New-Item -Path $AuthorizedKeysPath -ItemType File -Value $AuthorizedKey -Force + # Set the correct permissions on the authorized_keys file + icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r + icacls "C:\ProgramData\ssh\administrators_authorized_keys" /grant "Administrators:F" /grant "SYSTEM:F" + icacls "C:\ProgramData\ssh\administrators_authorized_keys" /remove "Users" + icacls "C:\ProgramData\ssh\administrators_authorized_keys" /remove "Authenticated Users" # Ensure the SSH agent pulls in the new key. Set-Service -Name ssh-agent -StartupType "Automatic" Restart-Service -Name ssh-agent + Restart-Service -Name sshd # Open the firewall for SSH connections New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 diff --git a/enos/modules/aws_rdp_member_server_with_worker/main.tf b/enos/modules/aws_rdp_member_server_with_worker/main.tf index 87a1ba3831..eb31700dd9 100644 --- a/enos/modules/aws_rdp_member_server_with_worker/main.tf +++ b/enos/modules/aws_rdp_member_server_with_worker/main.tf @@ -158,10 +158,16 @@ resource "aws_instance" "worker" { $AuthorizedKey = (Invoke-WebRequest -Uri 'http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key' -Headers $ImdsHeaders -UseBasicParsing).Content $AuthorizedKeysPath = 'C:\ProgramData\ssh\administrators_authorized_keys' New-Item -Path $AuthorizedKeysPath -ItemType File -Value $AuthorizedKey -Force + # Set the correct permissions on the authorized_keys file + icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r + icacls "C:\ProgramData\ssh\administrators_authorized_keys" /grant "Administrators:F" /grant "SYSTEM:F" + icacls "C:\ProgramData\ssh\administrators_authorized_keys" /remove "Users" + icacls "C:\ProgramData\ssh\administrators_authorized_keys" /remove "Authenticated Users" # Ensure the SSH agent pulls in the new key. Set-Service -Name ssh-agent -StartupType "Automatic" Restart-Service -Name ssh-agent + Restart-Service -Name sshd # Open the firewall for SSH New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 diff --git a/enos/modules/aws_windows_client/main.tf b/enos/modules/aws_windows_client/main.tf index 245fa546f3..837a9dbc6e 100644 --- a/enos/modules/aws_windows_client/main.tf +++ b/enos/modules/aws_windows_client/main.tf @@ -160,8 +160,8 @@ resource "aws_instance" "client" { # Set up SSH so we can remotely manage the instance ## Install OpenSSH Server and Client - # Loop to make sure that SSH installs correctly - $elapsed = 0 + # Loop to make sure that SSH installs correctly + $elapsed = 0 do { try { Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 @@ -215,10 +215,16 @@ resource "aws_instance" "client" { $AuthorizedKey = (Invoke-WebRequest -Uri 'http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key' -Headers $ImdsHeaders -UseBasicParsing).Content $AuthorizedKeysPath = 'C:\ProgramData\ssh\administrators_authorized_keys' New-Item -Path $AuthorizedKeysPath -ItemType File -Value $AuthorizedKey -Force + # Set the correct permissions on the authorized_keys file + icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r + icacls "C:\ProgramData\ssh\administrators_authorized_keys" /grant "Administrators:F" /grant "SYSTEM:F" + icacls "C:\ProgramData\ssh\administrators_authorized_keys" /remove "Users" + icacls "C:\ProgramData\ssh\administrators_authorized_keys" /remove "Authenticated Users" ## Ensure the SSH agent pulls in the new key. Set-Service -Name ssh-agent -StartupType "Automatic" Restart-Service -Name ssh-agent + Restart-Service -Name sshd ## Open the firewall for SSH connections New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22