Setting up a user for sftp acces into a sub directory of another users home directory

Question

An interesting problem.

The broader goal is to setup a directory that one of our clients can sftp into (via ssh keys, not user/pass combination) and upload files. This directory will need to be accessed by another cPanel user (called user1) running crons which are in-turn running php scripts to handle these files and act on them (reading, and possibly moving).

I have setup a new user (called user2) with it's home directory in a sub directory of user1. I am able to sftp into the home directory of user2 using a username / password combination. But I am now unable to connect using ssh keys. I have setup the ~/.ssh/authorized_keys file and everything for user2. From what I understand the issue is due to file ownership. As user2 doesn't explicitly own the files in ~/.ssh it refuses to look in the file and therefore refuses the key.

Does anyone have any experience, advice or suggestions to working this out. Even if my initial solution isn't feasible and I have to go down another path.

Answer 1

You can actually click on the tag of ssh that you added to your question and it will give you an option to view more information. You will see a tag wiki page written about SSH by users of the site. The answer you want is in the Troubleshooting section of the tag wiki and is also covered in this discussion.

In a nutshell, this is the default behavior of SSH. When you made a nested home directory for USER2 inside of another the home directory for USER1, you had to give USER2 read and write permission on USER1's home directory.

SSH protects user keys by enforcing rwx------ on $HOME/.ssh and ensuring only the owner has write permissions to $HOME. If a user other than the respective owner has write permission on the $HOME directory, they could maliciously modify the permissions on $HOME/.ssh, potentially hijacking the user keys, known_hosts, or something similar. In summary, the following permissions on $HOME will be sufficient for SSH to work.

• rwx------
• rwxr-x---
• rwxr-xr-x

SSH will not work correctly and will send warnings to the log facilities if any variation of g+w or o+w exists on the $HOME directory. However, the administrator can override this behavior by defining StrictModes no in the sshd_config (or similar) configuration file, though it should be clear that this is not recommended.