sshcfg-lint 0.1.0__tar.gz

sshcfg_lint-0.1.0/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 agent-one
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

sshcfg_lint-0.1.0/PKG-INFO

@@ -0,0 +1,39 @@
+Metadata-Version: 2.4
+Name: sshcfg-lint
+Version: 0.1.0
+Summary: Lint ~/.ssh/config: options shadowed by earlier Host blocks, duplicate hosts, missing/loose key files, ProxyJump loops. Stdlib only.
+Author-email: agent-one <rafal.baranowski.iot@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/rafal-one/sshcfg-lint
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# sshcfg-lint
+
+Lint your OpenSSH client config (`~/.ssh/config`). In ssh_config the **first** value found for an option wins, so a `Host *` block placed above a specific host silently overrides it. sshcfg-lint finds that and other common mistakes. Stdlib only, Python 3.9+.
+
+## Checks
+- an option in a `Host x` block overridden by an earlier matching block (the classic `Host *` / `User` trap)
+- duplicate `Host` patterns and options repeated within one block
+- `IdentityFile`/`CertificateFile` that do not exist; private keys readable by others; config writable by others (ssh refuses these)
+- `ProxyJump` loops or hops with no matching `Host`
+- deprecated options (`UseRoaming`, `Protocol`, ...)
+
+## Usage
+```console
+$ sshcfg-lint
+/home/me/.ssh/config:7: warn: user 'deploy' for web is overridden by 'root' at line 2 (Host * (line 1)); first match wins
+/home/me/.ssh/config:12: error: ~/.ssh/id_work is accessible by others (mode 0o644); ssh will refuse it
+$ sshcfg-lint --strict other_config   # exit 1 on warnings too
+```
+Options: `--no-files` (skip disk checks), `--strict`. Exit code 1 on errors, 2 if the file is unreadable. Not checked: `Match` blocks and `Include`.
+
+## Install
+`pip install sshcfg-lint` (once published) or copy `sshcfg_lint.py`.
+
+## Support
+MIT licensed. If it saves you time: https://paypal.me/RafalBaranowski

sshcfg_lint-0.1.0/README.md

@@ -0,0 +1,25 @@
+# sshcfg-lint
+
+Lint your OpenSSH client config (`~/.ssh/config`). In ssh_config the **first** value found for an option wins, so a `Host *` block placed above a specific host silently overrides it. sshcfg-lint finds that and other common mistakes. Stdlib only, Python 3.9+.
+
+## Checks
+- an option in a `Host x` block overridden by an earlier matching block (the classic `Host *` / `User` trap)
+- duplicate `Host` patterns and options repeated within one block
+- `IdentityFile`/`CertificateFile` that do not exist; private keys readable by others; config writable by others (ssh refuses these)
+- `ProxyJump` loops or hops with no matching `Host`
+- deprecated options (`UseRoaming`, `Protocol`, ...)
+
+## Usage
+```console
+$ sshcfg-lint
+/home/me/.ssh/config:7: warn: user 'deploy' for web is overridden by 'root' at line 2 (Host * (line 1)); first match wins
+/home/me/.ssh/config:12: error: ~/.ssh/id_work is accessible by others (mode 0o644); ssh will refuse it
+$ sshcfg-lint --strict other_config   # exit 1 on warnings too
+```
+Options: `--no-files` (skip disk checks), `--strict`. Exit code 1 on errors, 2 if the file is unreadable. Not checked: `Match` blocks and `Include`.
+
+## Install
+`pip install sshcfg-lint` (once published) or copy `sshcfg_lint.py`.
+
+## Support
+MIT licensed. If it saves you time: https://paypal.me/RafalBaranowski

sshcfg_lint-0.1.0/pyproject.toml

@@ -0,0 +1,25 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "sshcfg-lint"
+version = "0.1.0"
+description = "Lint ~/.ssh/config: options shadowed by earlier Host blocks, duplicate hosts, missing/loose key files, ProxyJump loops. Stdlib only."
+readme = "README.md"
+license = {text = "MIT"}
+requires-python = ">=3.9"
+authors = [{name = "agent-one", email = "rafal.baranowski.iot@gmail.com"}]
+classifiers = ["License :: OSI Approved :: MIT License", "Programming Language :: Python :: 3"]
+
+[project.urls]
+Homepage = "https://github.com/rafal-one/sshcfg-lint"
+
+[project.scripts]
+sshcfg-lint = "sshcfg_lint:main"
+
+[tool.setuptools]
+py-modules = ["sshcfg_lint"]
+
+[tool.pytest.ini_options]
+pythonpath = ["."]

sshcfg_lint-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

sshcfg_lint-0.1.0/sshcfg_lint.egg-info/PKG-INFO

@@ -0,0 +1,39 @@
+Metadata-Version: 2.4
+Name: sshcfg-lint
+Version: 0.1.0
+Summary: Lint ~/.ssh/config: options shadowed by earlier Host blocks, duplicate hosts, missing/loose key files, ProxyJump loops. Stdlib only.
+Author-email: agent-one <rafal.baranowski.iot@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/rafal-one/sshcfg-lint
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# sshcfg-lint
+
+Lint your OpenSSH client config (`~/.ssh/config`). In ssh_config the **first** value found for an option wins, so a `Host *` block placed above a specific host silently overrides it. sshcfg-lint finds that and other common mistakes. Stdlib only, Python 3.9+.
+
+## Checks
+- an option in a `Host x` block overridden by an earlier matching block (the classic `Host *` / `User` trap)
+- duplicate `Host` patterns and options repeated within one block
+- `IdentityFile`/`CertificateFile` that do not exist; private keys readable by others; config writable by others (ssh refuses these)
+- `ProxyJump` loops or hops with no matching `Host`
+- deprecated options (`UseRoaming`, `Protocol`, ...)
+
+## Usage
+```console
+$ sshcfg-lint
+/home/me/.ssh/config:7: warn: user 'deploy' for web is overridden by 'root' at line 2 (Host * (line 1)); first match wins
+/home/me/.ssh/config:12: error: ~/.ssh/id_work is accessible by others (mode 0o644); ssh will refuse it
+$ sshcfg-lint --strict other_config   # exit 1 on warnings too
+```
+Options: `--no-files` (skip disk checks), `--strict`. Exit code 1 on errors, 2 if the file is unreadable. Not checked: `Match` blocks and `Include`.
+
+## Install
+`pip install sshcfg-lint` (once published) or copy `sshcfg_lint.py`.
+
+## Support
+MIT licensed. If it saves you time: https://paypal.me/RafalBaranowski

sshcfg_lint-0.1.0/sshcfg_lint.egg-info/SOURCES.txt

@@ -0,0 +1,10 @@
+LICENSE
+README.md
+pyproject.toml
+sshcfg_lint.py
+sshcfg_lint.egg-info/PKG-INFO
+sshcfg_lint.egg-info/SOURCES.txt
+sshcfg_lint.egg-info/dependency_links.txt
+sshcfg_lint.egg-info/entry_points.txt
+sshcfg_lint.egg-info/top_level.txt
+tests/test_lint.py

sshcfg_lint-0.1.0/sshcfg_lint.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

sshcfg_lint-0.1.0/sshcfg_lint.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+sshcfg-lint = sshcfg_lint:main

sshcfg_lint-0.1.0/sshcfg_lint.egg-info/top_level.txt

@@ -0,0 +1 @@
+sshcfg_lint

sshcfg_lint-0.1.0/sshcfg_lint.py

@@ -0,0 +1,158 @@
+"""Lint an OpenSSH client config (~/.ssh/config): shadowed options, missing keys, loose permissions."""
+import argparse
+import fnmatch
+import os
+import re
+import stat
+import sys
+
+__version__ = "0.1.0"
+
+DEPRECATED = {
+    "useroaming": "removed in OpenSSH 7.x, ignored",
+    "protocol": "SSH protocol 1 support was removed",
+    "rsaauthentication": "protocol 1 only, removed",
+    "rhostsrsaauthentication": "protocol 1 only, removed",
+    "useprivilegedport": "removed",
+}
+# first value wins in ssh_config; these accumulate instead
+MULTI = {"identityfile", "localforward", "remoteforward", "dynamicforward", "sendenv",
+         "setenv", "certificatefile", "canonicaldomains", "permitremoteopen"}
+
+
+class Entry:
+    def __init__(self, line, key, value):
+        self.line, self.key, self.value = line, key, value
+
+
+class Block:
+    def __init__(self, line, patterns):
+        self.line, self.patterns, self.entries = line, patterns, []
+
+
+def split_args(s):
+    return [a.strip('"') for a in re.findall(r'"[^"]*"|\S+', s)]
+
+
+def parse(text):
+    """Return (blocks, notes). Block 0 holds options before any Host/Match."""
+    blocks = [Block(0, ["*"])]
+    for n, raw in enumerate(text.splitlines(), 1):
+        s = raw.strip()
+        if not s or s.startswith("#"):
+            continue
+        m = re.match(r"(\w+)\s*(?:=\s*|\s+)(.*)$", s)
+        if not m:
+            continue
+        key, val = m.group(1).lower(), m.group(2).strip()
+        if key == "host":
+            blocks.append(Block(n, split_args(val)))
+        elif key == "match":
+            blocks.append(Block(n, ["<match>"]))
+        else:
+            blocks[-1].entries.append(Entry(n, key, val))
+    return blocks
+
+
+def matches(patterns, host):
+    ok = False
+    for p in patterns:
+        if p.startswith("!"):
+            if fnmatch.fnmatchcase(host, p[1:]):
+                return False
+        elif fnmatch.fnmatchcase(host, p):
+            ok = True
+    return ok
+
+
+def lint(text, config_path=None, check_files=True):
+    """Return a list of (line, level, message)."""
+    out = []
+    blocks = parse(text)
+    seen = {}
+    for b in blocks[1:]:
+        for p in b.patterns:
+            if p in seen and not p.startswith("!") and p != "<match>":
+                out.append((b.line, "warn", f"Host {p!r} already defined at line {seen[p]}"))
+            seen.setdefault(p, b.line)
+    for b in blocks:
+        for e in b.entries:
+            if e.key in DEPRECATED:
+                out.append((e.line, "warn", f"{e.key}: {DEPRECATED[e.key]}"))
+        keys = {}
+        for e in b.entries:
+            if e.key in keys and e.key not in MULTI:
+                out.append((e.line, "warn", f"{e.key} repeated in the same block (line {keys[e.key]}); first value wins"))
+            keys.setdefault(e.key, e.line)
+    # shadowing: an earlier block that matches the later block's literal host sets the option first
+    for i, b in enumerate(blocks):
+        if i == 0:
+            continue
+        hosts = [p for p in b.patterns if not re.search(r"[*?!]", p) and p != "<match>"]
+        for e in b.entries:
+            if e.key in MULTI:
+                continue
+            for h in hosts:
+                for prev in blocks[:i]:
+                    if prev is b or "<match>" in prev.patterns or not matches(prev.patterns, h):
+                        continue
+                    hit = next((x for x in prev.entries if x.key == e.key), None)
+                    if hit and hit.value != e.value:
+                        where = "before any Host" if prev.line == 0 else f"Host {' '.join(prev.patterns)} (line {prev.line})"
+                        out.append((e.line, "warn",
+                                    f"{e.key} {e.value!r} for {h} is overridden by {hit.value!r} at line {hit.line} ({where}); first match wins"))
+                        break
+                else:
+                    continue
+                break
+    names = {p for b in blocks[1:] for p in b.patterns}
+    for b in blocks:
+        for e in b.entries:
+            if e.key == "proxyjump":
+                for hop in e.value.split(","):
+                    hop = hop.split("@")[-1].rsplit(":", 1)[0] if "[" not in hop else hop
+                    if hop.lower() != "none" and hop not in names and not any(
+                            matches(x.patterns, hop) for x in blocks[1:] if x is not b):
+                        out.append((e.line, "info", f"ProxyJump {hop!r} has no matching Host entry"))
+                    if hop in b.patterns:
+                        out.append((e.line, "error", f"ProxyJump {hop!r} points at its own block (loop)"))
+            if check_files and e.key in ("identityfile", "certificatefile", "userknownhostsfile") and "%" not in e.value:
+                for v in split_args(e.value):
+                    path = os.path.expanduser(v)
+                    if e.key == "userknownhostsfile" or v.startswith("~") is False and not os.path.isabs(path):
+                        continue
+                    if not os.path.exists(path):
+                        out.append((e.line, "warn", f"{e.key} {v} does not exist"))
+                    elif e.key == "identityfile" and os.stat(path).st_mode & 0o077:
+                        out.append((e.line, "error", f"{v} is accessible by others (mode {oct(stat.S_IMODE(os.stat(path).st_mode))}); ssh will refuse it"))
+    if config_path and os.path.exists(config_path):
+        mode = os.stat(config_path).st_mode
+        if mode & 0o022:
+            out.append((0, "error", f"{config_path} is writable by group/others (mode {oct(stat.S_IMODE(mode))}); ssh refuses it"))
+    return sorted(out, key=lambda x: x[0])
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(prog="sshcfg-lint", description=__doc__)
+    ap.add_argument("file", nargs="?", default=os.path.expanduser("~/.ssh/config"))
+    ap.add_argument("--no-files", action="store_true", help="do not check key files on disk")
+    ap.add_argument("--strict", action="store_true", help="exit 1 on warnings too")
+    ap.add_argument("--version", action="version", version=__version__)
+    a = ap.parse_args(argv)
+    try:
+        with open(a.file, encoding="utf-8", errors="replace") as f:
+            text = f.read()
+    except OSError as ex:
+        print(f"sshcfg-lint: {ex}", file=sys.stderr)
+        return 2
+    res = lint(text, a.file, not a.no_files)
+    for line, lvl, msg in res:
+        print(f"{a.file}:{line}: {lvl}: {msg}")
+    bad = any(l == "error" or (a.strict and l == "warn") for _, l, _ in res)
+    if not res:
+        print("ok")
+    return 1 if bad else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

sshcfg_lint-0.1.0/tests/test_lint.py

@@ -0,0 +1,72 @@
+from sshcfg_lint import lint, main
+
+
+def msgs(text, **kw):
+    return [m for _, _, m in lint(text, check_files=False, **kw)]
+
+
+def test_clean():
+    assert lint("Host a\n  User x\nHost *\n  ForwardAgent no\n", check_files=False) == []
+
+
+def test_shadowed_by_star_first():
+    r = msgs("Host *\n  User root\nHost web\n  User deploy\n")
+    assert any("overridden" in m and "root" in m for m in r)
+
+
+def test_same_value_not_shadowed():
+    assert msgs("Host *\n  User x\nHost web\n  User x\n") == []
+
+
+def test_identityfile_accumulates():
+    assert msgs("Host *\n  IdentityFile ~/a\nHost web\n  IdentityFile ~/b\n") == []
+
+
+def test_duplicate_host():
+    assert any("already defined" in m for m in msgs("Host a\n User x\nHost a\n User y\n"))
+
+
+def test_repeated_key_in_block():
+    assert any("repeated" in m for m in msgs("Host a\n User x\n User y\n"))
+
+
+def test_deprecated():
+    assert any("UseRoaming".lower() in m for m in msgs("Host a\n UseRoaming no\n"))
+
+
+def test_proxyjump_unknown_and_loop():
+    r = lint("Host a\n  ProxyJump a\nHost b\n  ProxyJump nope\n", check_files=False)
+    assert any(l == "error" for _, l, _ in r)
+    assert any("nope" in m for _, _, m in r)
+
+
+def test_equals_syntax_and_negation():
+    r = msgs("Host *\n  User=root\nHost web\n  User=deploy\n")
+    assert any("overridden" in m for m in r)
+    assert msgs("Host * !web\n  User root\nHost web\n  User deploy\n") == []
+
+
+def test_key_permissions(tmp_path):
+    k = tmp_path / "id"
+    k.write_text("x")
+    k.chmod(0o644)
+    r = lint(f"Host a\n  IdentityFile {k}\n")
+    assert any(l == "error" for _, l, _ in r)
+    k.chmod(0o600)
+    assert lint(f"Host a\n  IdentityFile {k}\n") == []
+    assert any("does not exist" in m for _, _, m in lint(f"Host a\n  IdentityFile {tmp_path}/nope\n"))
+
+
+def test_cli(tmp_path, capsys):
+    c = tmp_path / "config"
+    c.write_text("Host a\n  ProxyJump a\n")
+    c.chmod(0o600)
+    assert main([str(c)]) == 1
+    c.write_text("Host a\n  User x\n")
+    assert main([str(c)]) == 0
+    assert main([str(tmp_path / "missing")]) == 2
+    c.write_text("Host a\n  User x\nHost a\n")
+    assert main([str(c)]) == 0
+    assert main(["--strict", str(c)]) == 1
+    c.chmod(0o666)
+    assert main([str(c)]) == 1