/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen

  • Committer: Teddy Hogeborn
  • Date: 2024-11-17 17:28:47 UTC
  • Revision ID: teddy@recompile.se-20241117172847-3bon1o16owybrmoo
mandos: Make configured network socket non-inheritable

If we are passed a pre-created created network socket as a file
descriptor, we should make it non-inheritable to checkers and other
subprocesses.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen
437
437
            }
438
438
        }' < "$SECFILE"
439
439
    if [ -n "$ssh_fingerprint" ]; then
440
 
        if [ -n "$ssh_keyscan_quiet" ]; then
441
 
            echo "# Note: if the Mandos server has OpenSSH older than 9.8, the ${ssh_keyscan_quiet}"
442
 
            echo "# option *must* be removed from the 'checker' setting below"
443
 
        fi
444
440
        echo 'checker = ssh-keyscan '"$ssh_keyscan_quiet"'-t '"$ssh_keytype"' %%(host)s 2>/dev/null | grep --fixed-strings --line-regexp --quiet --regexp=%%(host)s" %(ssh_fingerprint)s"'
445
441
        echo "ssh_fingerprint = ${ssh_fingerprint}"
446
442
    fi