edemilov/Scripts
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: sshinstall.ps1 ACL idempotency + SID hardening + Move-Item safety

Browse Source 
- Fix ACL idempotency: check if ACLs already locked down before running
  icacls; use Write-Skip if no broader groups present, else re-lock
- Harden SID check: explicit SecurityIdentifier construction vs string coercion
- Add explicit New-Item for Move-Item destination in Win8 fallback

Co-Authored-By: Claude Haiku 4.5 <[email protected]>
This commit is contained in:
edemilovandClaude Haiku 4.5 committed 2026-09-17 15:14:28 +03:00
1 parent 902e95a79d
commit def3d57799
1 file changed
+12 -5
Download Patch File Download Diff File Expand all files Collapse all files
sshinstall.ps1
+12 -5
View File
@@ -45,6 +45,7 @@ if ($capability -and $capability.State -eq "Installed") {
Invoke-WebRequest -Uri $zipUrl -OutFile $zipPath
Expand-Archive -Path $zipPath -DestinationPath $env:ProgramFiles -Force
if (Test-Path "$env:ProgramFiles\OpenSSH-Win64") {
New-Item -ItemType Directory -Path $installDir -Force | Out-Null
Move-Item "$env:ProgramFiles\OpenSSH-Win64\*" $installDir -Force
Remove-Item "$env:ProgramFiles\OpenSSH-Win64" -Recurse -Force
}
@@ -82,7 +83,8 @@ if ($rule) {
# ── Deploy admin key ───────────────────────────────────────────────
Write-Header "Admin key"
$isAdminAccount = ([Security.Principal.WindowsIdentity]::GetCurrent().Groups -contains 'S-1-5-32-544')
$adminSid = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
$isAdminAccount = ([Security.Principal.WindowsIdentity]::GetCurrent().Groups -contains $adminSid)
if ($isAdminAccount) {
$keyFile = "$env:ProgramData\ssh\administrators_authorized_keys"
} else {
@@ -102,10 +104,15 @@ if ($existing -contains $AdminKey) {
}
if ($isAdminAccount) {
icacls $keyFile /inheritance:r | Out-Null
icacls $keyFile /grant "SYSTEM:F" | Out-Null
icacls $keyFile /grant "Administrators:F" | Out-Null
Write-Success "Locked down ACLs on $keyFile (SYSTEM + Administrators only)"
$aclOutput = (icacls $keyFile) -join "`n"
if ($aclOutput -match 'BUILTIN\\Users|Everyone|Authenticated Users|BUILTIN\\Guests') {
icacls $keyFile /inheritance:r | Out-Null
icacls $keyFile /grant "SYSTEM:F" | Out-Null
icacls $keyFile /grant "Administrators:F" | Out-Null
Write-Success "Locked down ACLs on $keyFile (SYSTEM + Administrators only)"
} else {
Write-Skip "ACLs on $keyFile"
}
}
Write-Host ""