My use case is to have a shared account for webmasters (named as domain) but only one of the webmasters is "owner" of main data and defines who can loging to the shared account via editing authorized_keys.

The problem is StrictModes yes would complain about ownership of .ssh/authorized_keys for shared account because it is owner by "owner" user.

Currently I have StrictModes yes but I use AuthorizedKeysCommand to make sshd work with .ssh/authorized_keys and not complain about bad ownership.

What is better - disable StrictModes or have my workaround?

This is Match for shared account:

Match Group *,!sftpuser,!sshuser
        ChrootDirectory %h # eg: /sites/<domain> # symlink to real dir in /sites/users/<user>/www/<domain>
        ForceCommand internal-sftp -u 0002 -d / -l INFO # here $HOME from /etc/passwd is broken, thus '-d /'
        # workaround - using script to validate ssh keys because 'StrictModes yes'
        # and we want authorized_key be owner by different user
        AuthorizedKeysCommand /etc/ssh/authorized_keys/bin/authorize_domain_sshkey %u
        AuthorizedKeysCommandUser %u

The dir layout is this:

/sites/users/<owner>/home/<owner> - owned by <owner>
/sites/users/<owner>/www/<domain>/.ssh - owned by <root>
/sites/users/<owner>/www/<domain>/.ssh/authorized_keys - owned by <owner>
/sites/users/<owner>/www/<domain>/htdocs - owned by <owner>/<domain>

shared account for has rwX, thus can modify data in 'htdocs'

It works now like this:

  • $owner puts new public ssh key into his $HOME/../../www//.ssh/authorized_keys
  • sftp $domain@host
  • $domain is chrooted in a dir which corresponds to above /sites/users/$owner/www/$domain
  • The script for AuthorizedKeysCommand basically does only cat /sites/${domain}/.ssh/authorized_keys 2>/dev/null where $domain is $1 passed to the script, thus %u from the sshd_config. – Jiri B Jan 11 at 13:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.