In my environment, actual .ssh directory exists on external device and links from it to
~/.ssh with a symbolic link. Using
openssh as client is working without problem, but
sshd does not allow to authentication with public key inside it.
Is there any method to use
.ssh directory on external device?
journalctl -u sshd
Authentication refused: bad ownership or modes for directory /pool/secure/ssh
$ ls -ld ~/.ssh lrwxrwxrwx. 1 foobar foobar 28 Mar 7 19:59 .ssh -> /pool/secure/ssh $ ls -l /pool/secure/ssh -rw------- 1 foobar foobar 381 Jun 29 15:01 authorized_keys -rw------- 1 foobar foobar 292 Jun 29 15:01 config -rw-------. 1 foobar foobar 5306 Jun 23 02:16 known_hosts $ ls -ld /pool/secure/ssh drwx------. 2 foobar foobar 8 Jun 29 15:01
$ ssh -V OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
Added at 2017-06-29 (Tips)
- OpenBSD and FreeBSD can modify access permission of symlink by chmod. But Linux does not have system call doing that operation.
- stat(2) follow the link.
- Base Specifications Issue 7 unspecified the value of the file mode bits returned in the st_mode field.
Solved at 2017-06-30
auth_secure_path have the answer. This function check permissions of file and directory, the range include parent directory. It continues to check if correct permissions (only owner can write) are set, until passing the home or root .
ex) general environment /home/foobar/.ssh (raise error if group and other can write) /home/foobar (same) break! ex) special environment (like me) /home/foobar/.ssh -> /pool/secure/ssh /pool/secure/ssh (raise error if group and other can write) /pool/secure (same) /pool (same) / (same) break!