AuthorizedKeysCommand size issue?
des at des.no
Wed Apr 16 04:39:05 EST 2014
Daniel Kahn Gillmor <dkg at fifthhorseman.net> writes:
> Dag-Erling Smørgrav <des at des.no> writes:
> > Or even 'echo "$(curl ...)"'
> This is potentially dangerous if curl produces a string that starts with
> a hyphen ("-"); in this case, echo will interpret the string as a set of
> option flags instead of as an argument to be repeated.
Technically, you're right.
In practice, it doesn't matter. The worst that will happen is that echo
will print something other than the contents of the file, and even that
can only happen if the file contains only "-n" or "-e", neither of which
is a valid authorized_keys file.
Dag-Erling Smørgrav - des at des.no
More information about the openssh-unix-dev