1

With Synology DSM 6 it seems that SSH requires users to be members of the admin group.

However, even in this case there seem to be problems with file/directory permissions that prevent key-based authentication succeeding for non-root users (standard /root/.ssh/authorized_keys works OK for root).

Specifically, SSH key-based authentication fails even with a correct ~/.ssh/authorized_keys in place.

0

Intro - Debugging SSH

First up, helpful note (for me anyway) when debugging SSH auth issues:

  1. Run a server in debug mode on the Synology:

    /bin/sshd -d -p 1234` as root;
    
  2. Log in from your client using

    ssh -p1234 -v <username>@<synology>
    

This will enable you to get easy access to helpful debug.

Step 1 - Update sshd configuration

Edit /etc/ssh/sshd_config and update the AuthorizedKeysFile configuration to support default plus alternate file location:

AuthorizedKeysFile /var/ssh-homes/%u/dot-ssh/authorized_keys .ssh/authorized_keys

Restart SSH server, most easily achieved in this case via the DSM GUI:

Steps: untick 'Enable SSH' --> apply --> re-tick --> apply

Terminal settings on Control Panel

Step 2 - Create alternate authorized_keys file for each applicable user

I created the script below as /root/prepare-dot-ssh-authorized-keys for this purpose as follows:

  1. Edit using vi /root/prepare-dot-ssh-authorized-keys or similar
  2. Make executable with chmod u+x /root/prepare-dot-ssh-authorized-keys
  3. Run with Synology user name /root/prepare-dot-ssh-authorized-keys <username>

References

Note there was some helpful discussion on the Synology forums Non-root SSH key authentication working with DSM 6.2.2-24922 Update 4 and ssh server refused key for all users but root which saved me some time and put me on the right track.

Script /root/prepare-dot-ssh-authorized-keys

#!/bin/bash -e

# https://community.synology.com/enu/forum/1/post/129890

if test -z "$1" ; then
    echo "usage: $0 <username>"
    echo ""
    echo "Ensure config in /etc/ssh/sshd_config includes:"
    echo "AuthorizedKeysFile /var/ssh-homes/%u/dot-ssh/authorized_keys .ssh/authorized_keys"
    exit 1
fi

_DIR="/var/ssh-homes/$1/dot-ssh"
_AK="${_DIR}/authorized_keys"

if test -d "${_DIR}" ; then
    echo "$0: ${_DIR} already exists"
    exit 2
fi

if test -r "${_AK}" ; then
    echo "$0: ${_AK} already exists"
    exit 3
fi

mkdir -p "${_DIR}"
chmod og-rwx `dirname "${_DIR}"`

touch "${_AK}"
chown "${1}.users" -R `dirname "${_DIR}"`

echo "$0: created ${_AK}"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.