mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-02 19:08:40 -04:00
59 lines
2.0 KiB
Go
59 lines
2.0 KiB
Go
package cmd
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
// SetSSHConfigCmdName is the hidden subcommand an elevated process runs to apply
|
|
// the privileged SSH settings.
|
|
const SetSSHConfigCmdName = "set-ssh-config"
|
|
|
|
// sshConfigElevated is set by runInDaemonMode once the dangerous SSH settings
|
|
// have been applied by an elevated helper, so the (unprivileged) up flow does
|
|
// not re-send them and re-trip the daemon gate.
|
|
var sshConfigElevated bool
|
|
|
|
// wantsDangerousSSH reports whether this invocation is trying to ENABLE SSH root
|
|
// login or DISABLE SSH authentication.
|
|
func wantsDangerousSSH(cmd *cobra.Command) bool {
|
|
return (cmd.Flags().Changed(enableSSHRootFlag) && enableSSHRoot) ||
|
|
(cmd.Flags().Changed(disableSSHAuthFlag) && disableSSHAuth)
|
|
}
|
|
|
|
// buildSetSSHConfigArgs builds the argument list for an elevated
|
|
// `netbird set-ssh-config` invocation.
|
|
func buildSetSSHConfigArgs(profileName, username string, enableSSHRoot, disableSSHAuth *bool, daemonAddr string) []string {
|
|
args := []string{SetSSHConfigCmdName}
|
|
if profileName != "" {
|
|
args = append(args, "--profile", profileName)
|
|
}
|
|
if username != "" {
|
|
args = append(args, "--username", username)
|
|
}
|
|
if enableSSHRoot != nil && *enableSSHRoot {
|
|
args = append(args, "--"+enableSSHRootFlag)
|
|
}
|
|
if disableSSHAuth != nil && *disableSSHAuth {
|
|
args = append(args, "--"+disableSSHAuthFlag)
|
|
}
|
|
if daemonAddr != "" {
|
|
args = append(args, "--daemon-addr", daemonAddr)
|
|
}
|
|
return args
|
|
}
|
|
|
|
// ElevateSSHConfig re-runs the current executable's `set-ssh-config` command with
|
|
// root/administrator privileges via the platform's prompt (pkexec/UAC/osascript),
|
|
// so the elevated process connects to the daemon with a privileged identity and
|
|
// the daemon's requirePrivilegedForDangerousSSH gate passes.
|
|
func ElevateSSHConfig(profileName, username string, enableSSHRoot, disableSSHAuth *bool) error {
|
|
exe, err := os.Executable()
|
|
if err != nil {
|
|
return fmt.Errorf("locate executable for elevation: %w", err)
|
|
}
|
|
return runElevated(exe, buildSetSSHConfigArgs(profileName, username, enableSSHRoot, disableSSHAuth, daemonAddr))
|
|
}
|