3

Strangest behavior I've seen in a while:

I have:

Setup a Linux user account with a password, and an ssh key.

  • When this user owns their home directory, they can login with the ssh key.
  • When this user does not own their home directory, sshd complains:

    Authentication refused: bad ownership or modes for directory /path/to/home/user/
    
  • When I remove the Linux account password: This user may login with their ssh key while not owning their home directory.

Wat? Why does sshd stop caring about them owning their home directory?

6
  • Who owns the home directory? Root, or some other user? May 16 '17 at 23:57
  • @Gilles In this case root was the owner of their home directory, do you think root-owned-homes are treated different than mis-owned homes? May 17 '17 at 0:03
  • I don't know the details, but yes, it makes a difference. A restricted account with a root-owned home (so that the user can't write to their home directory) is common. May 17 '17 at 0:04
  • By the way, when sshd complains, there should be detailed information in the system logs. Please copy all the relevant log lines into your question. May 17 '17 at 0:05
  • 1
    Because if someone else owns the home directory, they can unlink ~/.ssh/ and replace its contents with whatever they want.
    – Shadur
    May 17 '17 at 7:32
1

This is little bit more complicated than you are describing (and you omit many important details to completely answer this question). But the source code is a good place to start:

  • The failure is issued only if the public key authentication is performed
  • The parent directories are important and they are "accepted" only if
    • the sshd can stat() it
    • the directory is owned by the logging in user OR root on Linux (platform_sys_dir_uid() takes care of that)
    • the directory is not writable by any other user (the write bit can be set only for the owner)

This basically matches your first two points, but not the third one. There will be something else in round you changed or did not notice. Turn on the debug logging on the server and investigate it (or post it to the edited question).

2
  • On my third bullet, it was root who owned their home. I used sudo passwd -d <username> to clear the users password to get bullet 3 to function. Does that demystify anything? May 17 '17 at 16:33
  • No. When the home is owned by user or root, it should just work. If not, it should not. The presence of password does not matter.
    – Jakuje
    May 17 '17 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.