2

I have a CentOS 7 instance on AWS, and I connect using a .pem file. When I create a new user and follow the standard steps, (create .ssh directory, chmod 700 it, create authorized_keys file, copy the public key in, chmod 600 it. Instructions here: https://aws.amazon.com/premiumsupport/knowledge-center/new-user-accounts-linux-instance/ ) It works fine.

However when I create a new user with a non-standard home directory, I keep getting a permissions error. I tried creating a folder in the / directory, then when I noticed the perms didn't match the rest of the folders there, I created a new folder there using the root account, and then created a new user underneath that. (So basically /test/ was owned by root, /test/newuser/ was owned by new user.)

I followed the rest of the steps, but still, no luck.

I checked the /etc/ssh/sshd_config file and edited to:

AuthorizedKeysFile .ssh/authorized_keys /test/newuser/.ssh/authorized_keys

That didn't work either.

I should note that this setup works fine with amazon linux 2 images, but not with CentOS 7. Any suggestions?

1

Specify the non-standard home directory when creating the user with useradd command:

Create the base home directory

sudo mkdir /test

If SELinux is enabled and running in enforcing mode, you must relabel the files with correct SELinux context:

sudo semanage fcontext -a -t user_home_dir_t "/test(/.*)?"

Force SELinux to relabel the files on the fly

sudo restorecon -Rv /test

Then add users with custom home directories

sudo useradd -d /test/user1 user1
sudo useradd -d /test/user2 user2

These users will have correct permissions set for their home directories. More information on SELinux contexts and relabeling found here

3
  • Looks like it was the SE Linux commands that fixed it, thank you! – SB. Nov 12 '20 at 18:02
  • Bruce, could you please explain what those commands did, so I know what to look for in the future? – SB. Nov 12 '20 at 19:02
  • @SB I have edited the answer accordingly. Thank you – Bruce Malaudzi Nov 12 '20 at 20:33
1

Okay, I wanna be sure you have done the above, This solution is well tested on Centos 7 but not on AWS instance.

On your local server :
#Get the pub key
cat ~/.ssh/id_rsa.pub

On the remote server :

mkdir -p /test/newuser/.ssh/
chmod 700 /test/newuser/.ssh/
touch /test/newuser/.ssh/authorized_keys
chmod 600 /test/newuser/.ssh/authorized_keys
echo << EOF > /test/newuser/.ssh/authorized_keys
# ADD here  your ~/.ssh/id_rsa.pub already generated
EOF 
usermod -d /test/newuser test
chown root:root /test
chown -R test:test /test/*
#Edit/etc/ssh/sshd_config to add the above : 
Match User test
        AuthorizedKeysFile /test/newuser/.ssh/authorized_keys

Also could you copy the content of your sshd_config on the remote server :

grep -v '^#' /etc/ssh/sshd_config | sed '/^$/d'
2
  • Hey, thanks a bunch for helping. Bruce's answer was the solution in the end, had to do with SELinux. – SB. Nov 12 '20 at 19:04
  • I see it's normal it's because selinux will consider your home directory as the default one so you need so you need to reset your /test to the home directory context. – Reda Salih Nov 13 '20 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.