1

I have got question for you. I need to solve this problem.

I have got folder /keys which chmod 755 on /keys folder and ACL right such as setfacl -d -m u:myadmin:rwx /keys

In /keys folder are others folders such as user1, user2, user3

in each user1, user2, user3 folder are specific public.key for SSH access

And now there is my problem:

If I have got enable StrictModes in sshd_config, user1 during ssh connection received error message "Bad Ownership or Modes for Directory", because on folder user1 root has got rwx rights and also myadmin has got rwx rights. When I remove rights of myadmin all is OK and all is work. But I need have myadmin for manage public keys in these folders. So I tried disable StrictModes in sshd_config and all is OK and working. But I think disable StrictModes is not good idea for security. I have got all users, admins chrooted in specific folders in the system.

What do you think? There is any other solution for this problem? Or it can be disabled for solution of this problem ?


RE: All users are chrooted in the directory and can't login via putty,console..

They can connect only via ssh. After login they see their folders which specific rights, can't move outside from chrooted directory.

However I need each user need access specific folder which are on different place which is outside of chrooted folder of each user. User doesnt know about outside folder, its only for server access to write down some files. Thats all.

With setfacl -m u:user:rwx and StrictModes on user can't login via ssh. If i turn of StrictModes, user can connect via ssh.

I know StrictModes specifies wheter ssshd should check file modes and ownership of the user files and home directory before accepting login.

Or there is another solution ? Thanks

4
  • Sorry, but youn want to enable a feature that should not obey what it is supposed to da? That's beyond me.
    – stoney
    Jul 17, 2020 at 13:30
  • have you tried directories and files belonging to root and setfcal -m u:myadmin:rwx * (without -d) ?
    – Archemar
    Jul 17, 2020 at 13:39
  • Yep, i tried that
    – SED85
    Jul 20, 2020 at 4:24
  • ACL won't help you overcome chroot. I am not event sure you can store ssh keys (if that is the case) outside chroot. maybe the other way round, did you have a look at rsh (restricted shell) ? maybe use as user shell ?
    – Archemar
    Jul 20, 2020 at 14:45

1 Answer 1

0

Instead of using facls to give myadmin write permissions to that folder, you could have a few scripts that manipulate keys as desired, and give myadmin sudo rights to them.

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .