Error if private_key_file is group/world readable

Currently, if you have this, ansible fails with a generic error and
suggests running again with `-vvvv`. This isn't bad but pinpointing the
specific problem immediately is even more user-friendly.

```
$ ls -l devops.pem
-rw-r--r--+ 1 marca  staff  1679 Jul  2 11:25 devops.pem

$ ansible -m ping --private-key=devops.pem mt3-pyweb01
mt3-pyweb01 | FAILED => private_key_file (devops.pem) is group-readable or world-readable and thus insecure - you will probably get an SSH failure
```
pull/8020/head
Marc Abramowitz 10 years ago
parent 14cf3c4d2a
commit 5b783e0bc6

@ -18,6 +18,9 @@
################################################ ################################################
import os
import stat
from ansible import utils from ansible import utils
from ansible.errors import AnsibleError from ansible.errors import AnsibleError
@ -31,5 +34,12 @@ class Connector(object):
conn = utils.plugins.connection_loader.get(transport, self.runner, host, port, user=user, password=password, private_key_file=private_key_file) conn = utils.plugins.connection_loader.get(transport, self.runner, host, port, user=user, password=password, private_key_file=private_key_file)
if conn is None: if conn is None:
raise AnsibleError("unsupported connection type: %s" % transport) raise AnsibleError("unsupported connection type: %s" % transport)
if private_key_file:
# If private key is readable by user other than owner, flag an error
st = os.stat(private_key_file)
if st.st_mode & (stat.S_IRGRP | stat.S_IROTH):
raise AnsibleError("private_key_file (%s) is group-readable or world-readable and thus insecure - "
"you will probably get an SSH failure"
% (private_key_file,))
self.active = conn.connect() self.active = conn.connect()
return self.active return self.active

Loading…
Cancel
Save