0

I just created an ec2-instance with Amazon Linux 2 OS, then logged in to the system using login: ec2-user and an associated privatekey. Next, I created a new user x and copied the .ssh/authorized_keys file from the ec2-user home directory to the x user home directory. Finally, I changed ownership of the authorized_keys file to x.

sudo ls -ald /home/x/.ssh
drwxrwxr-x 2 x x 29 Sep 18 16:42 /home/x/.ssh

and

sudo ls -al /home/x/.ssh/authorized_keys
-rw------- 1 x x 387 Sep 18 16:42 /home/x/.ssh/authorized_keys

Now when I am logging as user x using the same private key, I am getting the error shown below:

ssh -i /some/path/aws/privatekey.pem x@a.b.c.d
x@a.b.c.d: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

How might one fix this so a successful login is possible?

(Does the authorized_keys file hold any user information too.)

A similar question that did not help: ssh : Permission denied (publickey,gssapi-with-mic)

1
drwxrwxr-x 2 x x 29 Sep 18 16:42 /home/x/.ssh

Your /home/x/.ssh has group write permission set, so theoretically another member of group x might have been able to tamper with the contents of the directory. And so, out of an abundance of caution, sshd will ignore the authorized_keys file.

The sshd(8) man page says:

~/.ssh/authorized_keys

If this file, the ~/.ssh directory, or the user's home directory are writable by other users, then the file could be modified or replaced by unauthorized users. In this case, sshd will not allow it to be used unless the StrictModes option has been set to “no”.

To fix it:

chmod go-w / /home /home/x /home/x/.ssh

Also, / and /home should of course be owned by root.

A user can grant others write access to other sub-directories of their home directory, but the home directory itself and the ~/.ssh/ sub-directory are security-sensitive and should always be writable for the user owning the directory only. There are many files (e.g. the ~/.profile, ~/.bashrc and similar login scripts) in the home directory that could be used for evil if they are left writeable for others.

Before SSH was developed, the ~/.rhosts file used by the old rsh/rlogin/rcp tools had similar protection requirements - and was similarly ignored if not adequately protected.

1
  • sudo ls -lrd /home/x/.ssh/ output: drwx------ 2 x x 29 Sep 18 18:42 /home/x/.ssh/ and it fixed. thx – samshers Sep 19 '20 at 5:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.