My use case is to have a shared account for webmasters (named as domain) but only one of the webmasters is "owner" of main data and defines who can loging to the shared account via editing authorized_keys.

The problem is StrictModes yes would complain about ownership of .ssh/authorized_keys for shared account because it is owner by "owner" user.

Currently I have StrictModes yes but I use AuthorizedKeysCommand to make sshd work with .ssh/authorized_keys and not complain about bad ownership.

What is better - disable StrictModes or have my workaround?

This is Match for shared account:

Match Group *,!sftpuser,!sshuser
        ChrootDirectory %h # eg: /sites/<domain> # symlink to real dir in /sites/users/<user>/www/<domain>
        ForceCommand internal-sftp -u 0002 -d / -l INFO # here $HOME from /etc/passwd is broken, thus '-d /'
        # workaround - using script to validate ssh keys because 'StrictModes yes'
        # and we want authorized_key be owner by different user
        AuthorizedKeysCommand /etc/ssh/authorized_keys/bin/authorize_domain_sshkey %u
        AuthorizedKeysCommandUser %u

The dir layout is this:

/sites/users/<owner>/home/<owner> - owned by <owner>
/sites/users/<owner>/www/<domain>/.ssh - owned by <root>
/sites/users/<owner>/www/<domain>/.ssh/authorized_keys - owned by <owner>
/sites/users/<owner>/www/<domain>/htdocs - owned by <owner>/<domain>

shared account for has rwX, thus can modify data in 'htdocs'

It works now like this:

  • $owner puts new public ssh key into his $HOME/../../www//.ssh/authorized_keys
  • sftp $domain@host
  • $domain is chrooted in a dir which corresponds to above /sites/users/$owner/www/$domain
  • The script for AuthorizedKeysCommand basically does only cat /sites/${domain}/.ssh/authorized_keys 2>/dev/null where $domain is $1 passed to the script, thus %u from the sshd_config. – Jiri B Jan 11 '19 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.