Private/Set-SshImportIdPermission.ps1
|
function Set-SshImportIdPermission { <# .SYNOPSIS Locks down NTFS ACLs on a .ssh path so OpenSSH will accept it (mirrors the intent of `chmod 600`/`chmod 700` on Unix). #> [CmdletBinding(SupportsShouldProcess)] param( [Parameter(Mandatory)] [string] $Path ) if (-not (Test-Path -Path $Path)) { return } if (-not $PSCmdlet.ShouldProcess($Path, 'Restrict NTFS permissions')) { return } # (OI)(CI) (object-inherit/container-inherit) flags only make sense on a # directory ACE; applying them to a file's ACE causes icacls to accept # the command but silently produce an empty ACL, locking everyone out # (including the owner). Files get a plain rights mask instead. $rights = if (Test-Path -Path $Path -PathType Container) { '(OI)(CI)F' } else { 'F' } icacls $Path /inheritance:r | Out-Null foreach ($grantee in Get-SshImportIdPermissionGrantee -Path $Path) { icacls $Path /grant:r "${grantee}:${rights}" | Out-Null } } |