Skip to content

SSH Key Deployment Security Fixes

Summary of Security Improvements

The command injection vulnerability in SSH key deployment has been addressed with the following changes to src/ssh_tunnel_manager/gui/components/ssh_key_deployment.py:

1. Input Validation (_validate_public_key method)

  • Added comprehensive SSH public key validation
  • Checks for valid key types: ssh-rsa, ssh-ed25519, ssh-ecdsa, ssh-dss, ecdsa-sha2-*
  • Prevents injection characters: ;, &&, ||, |, backticks, $, parentheses, etc.
  • Validates base64 key data to ensure it's properly formatted
  • Ensures minimum required components (key type and key data)

2. Command Injection Prevention

  • Shell escaping: Used shlex.quote() to properly escape user input
  • Applied to both sshpass and ssh-copy-id methods
  • Escapes both public key content and passwords

3. Secure SFTP Implementation (Paramiko method)

  • Replaced shell commands with SFTP operations for the paramiko method
  • Direct file operations instead of shell command execution
  • Proper permission setting using SFTP chmod
  • Duplicate key detection to prevent multiple entries

4. Password Security in Temporary Files

  • Secure escaping of passwords in temporary shell scripts
  • Maintained existing secure permissions (0o700) on temporary files

Security Features Implemented

Input Validation

def _validate_public_key(self, key_content: str) -> bool:
    # Validates SSH key format and prevents injection
    # Blocks dangerous characters and validates base64 encoding

Safe Command Construction

# Before (vulnerable):
f"echo '{self.public_key_content}' >> ~/.ssh/authorized_keys"

# After (secure):
escaped_key = shlex.quote(self.public_key_content.strip())
f"echo {escaped_key} >> ~/.ssh/authorized_keys"

SFTP Implementation

# Secure file operations instead of shell commands
sftp = ssh.open_sftp()
sftp.mkdir('.ssh')
sftp.chmod('.ssh', 0o700)
# Direct file writing with proper key deduplication

Testing Recommendations

  1. Test with malicious input: Verify that keys containing injection characters are rejected
  2. Test with valid keys: Ensure legitimate SSH keys are properly deployed
  3. Test all three methods: ssh-copy-id, sshpass, and paramiko methods
  4. Test error handling: Verify secure error messages without information disclosure

Security Benefits

  • Eliminates command injection vulnerabilities
  • Validates input format and safety
  • Uses secure file operations where possible
  • Maintains backwards compatibility
  • Provides multiple secure deployment methods

The SSH key deployment functionality is now secure against command injection attacks while maintaining full functionality.