From: Eric S. Raymond <esr@thyrsus.com>
Date: Thu, 22 Mar 2012 10:12:09 +0000 (-0400)
Subject: Don't create the site record file by default.
X-Git-Tag: 1.7~7
X-Git-Url: http://thyrsus.com/gitweb/?a=commitdiff_plain;h=4928974c3ff1ec107e6838af4ce19f7c7de5e966;p=ssh-installkeys.git

Don't create the site record file by default.
---

diff --git a/ssh-installkeys b/ssh-installkeys
index bb5c047..7b1b1ff 100755
--- a/ssh-installkeys
+++ b/ssh-installkeys
@@ -632,14 +632,16 @@ class ssh_session:
 
 class KeyConfig(ConfigParser.RawConfigParser):
     "Store our state about remote keys."
-    @staticmethod
-    def configfile():
-        return os.path.expanduser('~/.ssh-installkeys')
     def __init__(self):
         ConfigParser.RawConfigParser.__init__(self)
+        self.have_config = os.path.exists(KeyConfig.configfile())
         self.read(KeyConfig.configfile())
+    @staticmethod
+    def configfile():
+        return os.path.expanduser('~/.ssh-installkeys')
     def save(self):
-        self.write(open(KeyConfig.configfile(), "w"))
+        if self.have_config:
+            self.write(open(KeyConfig.configfile(), "w"))
     def readremote(self, session):
         authorized = session.ssh("cat ~/.ssh/authorized_keys")
         keydict = {}
diff --git a/ssh-installkeys.xml b/ssh-installkeys.xml
index 5252b1a..768d333 100644
--- a/ssh-installkeys.xml
+++ b/ssh-installkeys.xml
@@ -42,17 +42,32 @@ public keys should be installed.  If it contains a @, the part before
 the @ will be clipped off and used as the login name. Otherwise your
 local login name will be used.</para>
 
-<para>Places where you install keys will be recorded in
-<filename>~/.ssh/installkeys</filename>. This configuration file will 
-also be updated when you use the check option, so you can use
-that option to check sites where you may have previously installed
-keys and add them to the list.</para>
-
 <para>Note: this script does not parse your ssh configuration &mdash;
 therefore, if you have specified a different remote user in your
 configuration, this script will not know that.  You can use the
 user@host syntax to force the remote username.</para>
 
+</refsect1>
+<refsect1><title>Recording remote key locations</title>
+
+<para>If the file <filename>~/.ssh/installkeys</filename> exists,
+places where you install keys will be recorded in it. This record will 
+also be updated when you use the check option, so you can use
+that option to check sites where you may have previously installed
+keys and add them to the list. Entries are removed when you
+delete remote keys.</para>
+
+<para>Beware that if your account is cracked, this record will offer
+the intruder a menu of other systems to attack, escalating security
+risks. Thus, to enable the recording feature, you must explicitly
+create <filename>~/.ssh/installkeys</filename> using
+<citerefentry><refentrytitle>touch</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+or some other means. This tool will not create the file for
+you.</para>
+
+</refsect1>
+<refsect1><title>Options</title>
+
 <para>Invoked with the <option>-h</option> option, the program prints
 a usage summary and exits.</para>
 
@@ -71,8 +86,14 @@ configuration entries for any such keys are also removed.</para>
 
 <para>The <option>-v</option> option says to report all commands and
 responses during the session. It's mainly useful for debugging.</para>
+
 </refsect1>
+<refsect1><title>Files</title>
+
+<para>Sites where keys have been installed may be recorded in
+<filename>~/.ssh/installkeys</filename>.</para>
 
+</refsect1>
 <refsect1><title>Requirements</title>
 <para><command>ssh-installkeys</command> was written in Python 2.2a1.  It
 will not work under Python 1.5.2. </para>