Stop changing permissions on `$HOME/.ssh`

[MayeulC]

nextcloud_ynh/scripts/upgrade

Line 320 in bcba5c3

setfacl --modify g:$app:rwx "/home/$u" || true

This locked me out of my server twice: this line changes the home directory permissions and its subfolders, including .ssh/

$HOME/.ssh has strict permissions requirements. With this change, I cannot login anymore after nextcloud updates, and I must connect a keyboard & a screen to my server.

I understand the use-case for this option (though I do not recall ever enabling it), but I think that it should at least exclude $HOME/.ssh, or restore previous/stock permissions on that folder.

[ewilly]

That command is not recursive and only touch $HOME so i don't see how to eclude the impact on $HOME/.ssh. If you don't need that functionnality you could set the ynh nextcloud setting user_home to false and in future upgrade that command will not anymore be executed.

[MayeulC]

you could set the ynh nextcloud setting

Right, I am planning to do that as soon as I have access to my server again. I am not sure I have it set, please see below.

That command is not recursive

Ah, you are right. It must have happened during another step, such as restore after failing upgrade:

nextcloud_ynh/scripts/restore

Lines 75 to 77 in bcba5c3

	for u in $(ynh_user_list); do
	setfacl --recursive --modify g:$app:rwX,d:g:$app:rwX "/home/$u" || true
	done

Hmm, I also notice that this code block does not check the value of $user_home. After double-checking, it looks like my update also failed this morning and the app was restored, so this is probably what happened (if I do not have $user_home set). Do you want me to submit a PR to add a check for $user_home?

Even when this variable is set, it is probably a good idea to avoid setting it on $HOME/.ssh. I am not sure how best to exclude this subfolder. Maybe just remove the acl on this folder after the modification? I'll confirm this evening whether this is enough.

[ewilly]

Yes that is missing in restore script

nextcloud_ynh/scripts/upgrade

Line 313 in bcba5c3

if [ $user_home -eq 1 ]; then

Yes you can propose a PR.
You can check your setting value with ynh_app_setting_get --app=nextcloud --key=user_home (see https://doc.yunohost.org/en/dev/packaging/scripts/helpers_v2.1#setting)

[MayeulC]

All right, I will make a PR.

You can check your setting value with

Well, I could, if I was not locked out 😅 I am not at home right now, unfortunately (protip: a HDMI -> USB adapter works well to use a laptop as an external screen, this is what I used last time).

[kay0u]

@MayeulC

Well, I could, if I was not locked out 😅 I am not at home right now, unfortunately (protip: a HDMI -> USB adapter works well to use a laptop as an external screen, this is what I used last time).

Protips2, install shellinabox, in private (if you still can do it because it's maybe not available anymore in the catalog, or it may works with the "install a custom app" at the bottom of the app install screen), it's technically a connection to a /dev/tty, not ssh. It already saves me when I was locked out like you ;)

[MayeulC]

So yeah, I confirm it is set to "0".

As for shellinabox I used to have it installed on my server, and I agree that it has been helpful more than once. I uninstalled it when I noticed it was unmaintained / unavailable, as I did not want another possible security liability. Maybe I should install it back and make it listen on my VPN interfaces (tailscale, wireguard). I am also thinking of setting up a KVM, either a "pikvm"-like using the USB adapter or something more barebones like an ESP8266/esp32 connected to the UART.

Anyway, I submitted a PR with two commits against testing, though in my opinion this would be a good candidate to have rather quickly in the main branch.