Consequences of .ssh/authorized_keys being world-readable

Question

OpenSSH sshd enforces mode 0600 for authorized_keys when StrictMode is enabled. How is mode 0644 more vulnerable?

Answer 1

The sshd_config man page says

StrictModes
Specifies whether sshd(8) should check file modes and ownership of the user's files and home directory before accepting login. This is normally desirable because novices sometimes accidentally leave their directory or files world-writable. The default is yes. Note that this does not apply to ChrootDirectory, whose permissions and ownership are checked unconditionally.

I believe this refers not to ~/.ssh/authorized_keys but rather to ~/.ssh itself, which typically contains your private keys. With ~/.ssh set to mode 0700 (drwx------), nothing inside it can be accessed by other users (except root). This happens to mean authorized_keys itself cannot be world-readable (unless you use the AuthorizedKeysFile config item to specify another location).

The risks to a publicly-visible ~/.ssh/authorized_keys file are pretty minimal but do exist: if you have compromised keys (the attacker has access to them) or keys that are weak (e.g. low bit size or old cryptosystem), an attacker might be able to replicate or use those keys and this file might tell them which system(s) to try them on.

Consider CVE-2008-0166, a bug in Debian's OpenSSL build's random number generator. Debian had to create the openssh-blacklist package as a short-term solution to ensure the weak keys could be weeded out.

Answer 2

One of the principles of information security is to restrict permissions and privileges as much as possible. Under this principle, only the minimum necessary permissions and privileges are granted to users, files, processes, etc. StrictMode applies this principle.

The reason for this principle is to reduce the chances of giving an attacker something that could be useful to him/her. In this case, an attacker that has read access to authorized_keys would be able see other hosts are able to connect to this host. Knowing this information, the attacker could then look for ways to breach one of these other hosts, in order to gain access to this host. The philosophy here is - why give the attacker something that he/she may be able to use, when there is nothing to be gained by doing so?