Don't create the site record file by default.

diff --git a/ssh-installkeys b/ssh-installkeys
index bb5c047896cffd7e313e577bb4e9e968489f2ca6..7b1b1ff12676e4402ba867508bffe18564e6b54e 100755 (executable)
--- a/ssh-installkeys
+++ b/ssh-installkeys
@@ -632,14 +632,16 @@ class ssh_session:
 
 class KeyConfig(ConfigParser.RawConfigParser):
     "Store our state about remote keys."
-    @staticmethod
-    def configfile():
-        return os.path.expanduser('~/.ssh-installkeys')
     def __init__(self):
         ConfigParser.RawConfigParser.__init__(self)
+        self.have_config = os.path.exists(KeyConfig.configfile())
         self.read(KeyConfig.configfile())
+    @staticmethod
+    def configfile():
+        return os.path.expanduser('~/.ssh-installkeys')
     def save(self):
-        self.write(open(KeyConfig.configfile(), "w"))
+        if self.have_config:
+            self.write(open(KeyConfig.configfile(), "w"))
     def readremote(self, session):
         authorized = session.ssh("cat ~/.ssh/authorized_keys")
         keydict = {}

diff --git a/ssh-installkeys.xml b/ssh-installkeys.xml
index 5252b1a02c4799451fa2799f0c843725399565e4..768d33337014ee715bbf6ccea408b77971a5bf29 100644 (file)
--- a/ssh-installkeys.xml
+++ b/ssh-installkeys.xml
@@ -42,17 +42,32 @@ public keys should be installed.  If it contains a @, the part before
 the @ will be clipped off and used as the login name. Otherwise your
 local login name will be used.</para>
 
-<para>Places where you install keys will be recorded in
-<filename>~/.ssh/installkeys</filename>. This configuration file will 
-also be updated when you use the check option, so you can use
-that option to check sites where you may have previously installed
-keys and add them to the list.</para>
-
 <para>Note: this script does not parse your ssh configuration &mdash;
 therefore, if you have specified a different remote user in your
 configuration, this script will not know that.  You can use the
 user@host syntax to force the remote username.</para>
 
+</refsect1>
+<refsect1><title>Recording remote key locations</title>
+
+<para>If the file <filename>~/.ssh/installkeys</filename> exists,
+places where you install keys will be recorded in it. This record will 
+also be updated when you use the check option, so you can use
+that option to check sites where you may have previously installed
+keys and add them to the list. Entries are removed when you
+delete remote keys.</para>
+
+<para>Beware that if your account is cracked, this record will offer
+the intruder a menu of other systems to attack, escalating security
+risks. Thus, to enable the recording feature, you must explicitly
+create <filename>~/.ssh/installkeys</filename> using
+<citerefentry><refentrytitle>touch</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+or some other means. This tool will not create the file for
+you.</para>
+
+</refsect1>
+<refsect1><title>Options</title>
+
 <para>Invoked with the <option>-h</option> option, the program prints
 a usage summary and exits.</para>
 
@@ -71,8 +86,14 @@ configuration entries for any such keys are also removed.</para>
 
 <para>The <option>-v</option> option says to report all commands and
 responses during the session. It's mainly useful for debugging.</para>
+
 </refsect1>
+<refsect1><title>Files</title>
+
+<para>Sites where keys have been installed may be recorded in
+<filename>~/.ssh/installkeys</filename>.</para>
 
+</refsect1>
 <refsect1><title>Requirements</title>
 <para><command>ssh-installkeys</command> was written in Python 2.2a1.  It
 will not work under Python 1.5.2. </para>