0

In the Debian 9 server I have, these are the least restrictive permissions I can set for SSH login with public key to work:

/home/user                          775
/home/user/.ssh                     775
/home/user/.ssh/authorized_keys     644

Any less restrictive permissions results in SSH asking passwords.

But in my Ubuntu 20, any permissions work for SSH. What is the reason for this? Is there a security feature that should be enabled in Ubuntu? Indeed the guard in Debian makes sense. When one set group writes permissions for authorized_keys, it can be easily compromised by other users.

3
  • I'm unable to recreate your results in Ubuntu 20.04.4 LTS. authorized_keys is originally set to 600, changing to to 644 still allows login. Changing it to 666 breaks login. Making .ssh world writeable (from 700 -> 702) breaks login.
    – kenlukas
    Sep 7, 2022 at 16:50
  • 2
    I'm guessing StrictMode is set to no in /etc/ssh/sshd_config
    – kenlukas
    Sep 7, 2022 at 17:08
  • @kenlukas it is StrictModes thanks.
    – Ehsan88
    Sep 8, 2022 at 20:29

1 Answer 1

1

By default, permissions for ~/.ssh must be limited to the user in question. I don't think this has changed in the history of OpenSSH or its packages for Debian or Ubuntu.

This is controlled by StrictModes documented in man 5 sshd_config (for your versions in question, see Ubuntu 20.04 (Focal) docs vs Debian 9 (Stretch) docs). This section is identical between those two:

StrictModes
Specifies whether sshd(8) should check file modes and ownership of the user's files and home directory before accepting login. This is normally desirable because novices sometimes accidentally leave their directory or files world-writable. The default is yes. Note that this does not apply to ChrootDirectory, whose permissions and ownership are checked unconditionally.

My best guess is that your Ubuntu system has been configured to set StrictModes no, which is strongly discouraged. I suggest changing it back to yes.

It is best for ~/.ssh directories to be mode 0700 (drwx------) and home directories to be writable only by their owners (so ~/.ssh isn't overwritten). I don't think the permissions on ~/.ssh/authorized_keys matter since only you and root can even see that it exists, but it's still best to keep at 600 (-rw-------) or 644 (-rw-r--r--).

2
  • Thanks. Setting StrictModes to yes fixed it. It's strange why the VPS provider has commented this line. Or is this default behavior in Ubuntu?
    – Ehsan88
    Sep 8, 2022 at 20:29
  • Definitely not the default on Ubuntu or Debian. I'm guessing your VPS provider did it to address some permissioning issue with their provisioning scripts.
    – Adam Katz
    Sep 8, 2022 at 20:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .