2

I'm trying ssh-ing into a rooted Android phone, but it gives me an error Permission denied (publickey)., and the log says Authentication refused: bad ownership or modes for directory, despite of the fact I have configured the permissions and ownerships carefully and correctly as shown below.

Here is the content of the file sshd_config.

  • /data/ssh/sshd_config
AuthorizedKeysFile /data/.ssh/authorized_keys
ChallengeResponseAuthentication no
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin yes
Subsystem sftp internal-sftp
pidfile /data/ssh/sshd.pid

Here is the content of the file 99sshd.

  • /data/local/userinit.d/99sshd
#!/system/bin/sh

umask 077

# DEBUG=1

DSA_KEY=/data/ssh/ssh_host_dsa_key
DSA_PUB_KEY=/data/ssh/ssh_host_dsa_key.pub
RSA_KEY=/data/ssh/ssh_host_rsa_key
RSA_PUB_KEY=/data/ssh/ssh_host_rsa_key.pub
AUTHORIZED_KEYS=/data/.ssh/authorized_keys
DEFAULT_AUTHORIZED_KEYS=/data/.ssh/authorized_keys

if [ ! -f $DSA_KEY ]; then
    /system/bin/ssh-keygen -t dsa -f $DSA_KEY -N ""
    chmod 600 /$DSA_KEY
    chmod 644 $DSA_PUB_KEY
fi

if [ ! -f $RSA_KEY ]; then
    /system/bin/ssh-keygen -t rsa -f $RSA_KEY -N ""
    chmod 600 /$RSA_KEY
    chmod 644 $RSA_PUB_KEY
fi

if [[ ! -f $AUTHORIZED_KEYS && -f $DEFAULT_AUTHORIZED_KEYS ]]; then
    cat $DEFAULT_AUTHORIZED_KEYS > $AUTHORIZED_KEYS
fi


if [ "1" == "$DEBUG" ] ; then
    # run sshd in debug mode and capture output to logcat
    /system/bin/logwrapper /system/bin/sshd -f /data/ssh/sshd_config -D -d
else
    # don't daemonize - otherwise we can't stop the sshd service
    /system/bin/sshd -f /data/ssh/sshd_config -D
fi

Also I'm making sure the client pubkey is in /data/.ssh/authorized_keys.

Now, here are the permissions and ownerships of the related files and directories.

# ls -alt /data/ssh
total 56
-rw-r--r--  1 root   root      6 2023-11-16 11:56 sshd.pid
-rw-rw----  1 root   root    269 2023-11-16 10:53 sshd_config
drwxrwx--x 54 system system 4096 2023-11-16 10:47 ..
drwxr-x---  3 root   shell  4096 2023-11-16 10:13 .
-rw-------  1 root   root    505 2023-11-16 10:11 ssh_host_ecdsa_key
-rw-r--r--  1 root   root    176 2023-11-16 10:11 ssh_host_ecdsa_key.pub
-rw-------  1 root   root    411 2023-11-16 10:11 ssh_host_ed25519_key
-rw-r--r--  1 root   root     96 2023-11-16 10:11 ssh_host_ed25519_key.pub
-rw-r--r--  1 root   root    604 2023-11-16 10:11 ssh_host_dsa_key.pub
-rw-------  1 root   root   1381 2023-11-16 10:11 ssh_host_dsa_key
-rw-r--r--  1 root   root    568 2023-11-16 10:11 ssh_host_rsa_key.pub
-rw-------  1 root   root   2602 2023-11-16 10:11 ssh_host_rsa_key
drw-------  2 root   shell  4096 1974-02-26 03:43 empty
# ls -alt /data/.ssh
total 16
drwxrwx--x 54 system system 4096 2023-11-16 10:47 ..
-rw-------  1 root   root   1144 2023-11-16 10:17 authorized_keys
drwx------  2 root   root   4096 2023-11-16 10:00 .
# ls -alt /data/local/userinit.d/99sshd
-rwxr-xr-x 1 root root 969 2023-11-16 10:54 /data/local/userinit.d/99sshd

Now run the sshd server.

# /data/local/userinit.d/99sshd

On a client machine, I try to connect to the phone like usual.

PS C:\Users\user> ssh [email protected]
[email protected]: Permission denied (publickey).

And fails as the error as shown above.

So I checked the log on the phone, the log says like this below.

# logcat | grep -i ssh
11-16 11:56:28.394 10599 10599 I /system/bin/sshd: Authentication refused: bad ownership or modes for directory /data

But I can't see any permissions or ownerships problem forthe related files, as I've shown above.

For a Note, I referenced:

The phone is:

  • ASUS ZenFone3 Android 10

Thanks for your help.

6
  • And what are the rights on /data itself ?
    – admstg
    Nov 16, 2023 at 8:34
  • Hi. Like this? # # ls -alt / total 160 drwxrwx--x 54 system system 4096 2023-11-16 10:47 data Nov 16, 2023 at 8:50
  • But, do you mean I could try chown root:root /data? (If so I did think it could cause a trouble on the phone, no?) Nov 16, 2023 at 8:51
  • Doing a chown shouldn't be the way, but root doesn't have any rights for reading in /data (except if part of the system group) so I would prefer a chmod o+r /data
    – admstg
    Nov 16, 2023 at 9:43
  • Thanks. I did chmod o+r /data and now the /data dir is drwxrwxr-x. But still I got the same error. Nov 16, 2023 at 10:11

1 Answer 1

1

You should set /data and its subdirectories to be owned by root with permissions 0755 (rwxr-xr-x). Alternately, you can disable this permissions check by setting StrictModes to "no" in the sshd_config file on the phone.

The error message is specifically about the /data directory. According to the source code, for the authorized_keys file, sshd checks that all directories in the absolute path to the file are owned by either the user or root, and that no directory is group- or world-writable. In your case, this is the /data directory:

drwxrwx--x 54 system system 4096 2023-11-16 10:47 ..

In other words, group write access is enabled, and (until you changed it in the comments), the owner and group is "system". Both of these are unacceptable for a login attempt as "root".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .