cccb-website-team/kik-website
Watch
0
0
Fork
You've already forked kik-website
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Keep the home directory and the files in it from being deleted

Browse source 
The user could delete the whole home directory, which takes the website
down with it: sshd cannot log in without it. The home directory and the
files that have to stay in it now belong to the administrators, so the
user may change them but not remove them. Their own files stay theirs.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Zebreus 2026-10-25 15:04:48 +01:00
commit bc7cb26b61
1 changed files with 45 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

12
server/README.md
View file

@ -17,17 +17,18 @@ We only keep the basic user journey working.
## What we keep working
- The prompt: `root@khaos-im-kiez:~#`, which `~/.zshrc` sets.
- The home directory the user ends up in: `/home/root`. They can delete it, but not change where it is.
- The home directory the user ends up in: `/home/root`. They cannot change where it is, and they cannot delete it.
- `cat README`, `cat README.en`, `cat CODE_OF_CONDUCT` and `cat CODE_OF_CONDUCT.en` always work. The four files
are always there and always regular text files.
- The website can log in: the key it uses is in `~/.ssh/authorized_keys`. That key gets access to the `root` user
only, never to the Administrator account.
Modifying the four files is allowed; the next cleanup undoes it. Deleting them is not permanent either.
Modifying the four files is allowed; the next cleanup undoes it. Deleting them is not possible: the home directory
and the files that have to stay in it belong to the administrators, so the user cannot remove them. The files the
user creates are their own; they may change and delete them.
The user may add keys of their own to `authorized_keys`; they stay. The key of the website is put back, so that the
site keeps working. The user owns their home directory, so they can always delete the file - nothing on Windows can
stop them from that - but the next cleanup brings it back. Until then, the site cannot log in.
site keeps working.
## What we do not keep working
@ -46,7 +47,8 @@ administrators. Neither the setup nor the cleanup ever runs as the `root` user.
It creates `/home/root` if it is gone, and puts the copies from `C:\ProgramData\kik-restore\files` back into the
home directory: the shell configuration, the keys and the four text files. Anything that is not a regular file is
replaced, so that the files cannot become anything but text.
replaced, so that the files cannot become anything but text. It also sets the permissions of the home directory and
of those files, so that the user cannot delete them.
## Installing the cleanup on the server