2

For some reasons, I NEED the home directory of some particular user to be group-writable. However, when trying to login to that user with ssh key, sshd refuses the authentication, as it requires the home directory to be writable by noone else than owner. In case it is group- or world-writable, sshd rejects authentication with the (in)famous message "Authentication refused: bad ownership or modes for directory /home/user".

Is there any way (except recompiling sshd) to force it to accept key authentication even when home directory is group-writable? Maybe place ssh keys in a different directory, outside of user's home dir, and tell sshd to use these keys?

Improve this question
6
  • Perhaps a better approach would be to move that user's AuthorizedKeysFile to a different location (a typical alternative is something like /etc/ssh/authorized_keys/%u )
    – steeldriver
    Jun 1, 2022 at 12:46
  • @steeldriver But can this be changed only for a single user, while leaving other users' authorized keys file in default location? If yes, that would be definitely the best approach. My impression was that AuthorizedKeysFile is a global setting for all users.
    – raj
    Jun 1, 2022 at 12:48
  • Yes, it should be possible with a Match user directive
    – steeldriver
    Jun 1, 2022 at 12:50
  • @steeldriver Looks that it won't work :( sshd refuses to start with a message: Directive 'AuthorizedKeysFile' is not allowed within a Match block. But I found another solution :) I will describe it.
    – raj
    Jun 1, 2022 at 13:11
  • That's odd - I checked before posting and it's included in the "subset of keywords [that] may be used on the lines following a Match keyword" in the sshd man page
    – steeldriver
    Jun 1, 2022 at 13:15

1 Answer 1

Reset to default
4

Found a solution myself :) There are in fact two different possibilities.

First is to set the option StrictModes to no (default is yes) in /etc/ssh/sshd_config file. With that setting, sshd does not enforce permissions on users home dir. The downside of this method is that it is global for all users.

The second method is to use the AuthorizedKeysCommand option. We need to write a simple script, that for that particular user name (it is pased to the script as a first parameter) will output that user's authorized keys file - whenever it is located - and for other values of the first parameter it will simply do nothing. Something like:

#!/bin/sh
if [ "$1" = "user" ]; then
  cat /usr/local/etc/users_authorized_keys
fi

If the script is placed for example in /usr/local/libexec/listkeys, then we need to put the following line into /etc/ssh/sshd_config file:

AuthorizedKeysCommand /usr/local/libexec/listkeys

With that solution, /home/user directory can be group writable, while for other users the permissions for home directory are still enforced.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .