up vote 1 down vote favorite
share [g+] share [fb]

Having set up a SuSE machine for a couple of co-developers, I found that SuSE does user permissions differently (all users being group "users", umask 022) than the RedHad / Gentoo way I am used to (all users having their own group, umask 002).

Thus, I went along and deleted all users, and re-created them each having their own group, and setting umask 002 globally.

However, after I did that, SSH pubkey authentication no longer works.

It did work before, and the ~/.ssh directory does have mode 700, and the ~(/.ssh/authorized_keys file does have mode 600, but SSH still insists on asking for a password, which it didn't do before the rework.

What did I miss?

link|improve this question
100% accept rate
1  
Is the home directory also non-group-writable? If so, what appears in the logs from sshd when you try to log in? – Gilles Aug 10 '10 at 12:03
Phrase it as an answer and you get the tick. Even if I had a look at the logs I wouldn't have thought the g+w on the home directory itself would make any difference, but it was indeed the culprit. – DevSolar Aug 10 '10 at 13:08
feedback

1 Answer

up vote 2 down vote accepted

The ssh daemon requires the whole chain of directory accesses from / to ~/.ssh/authorized_keys to be writable only by the user (and root), and in particular each of these must be non-group-writable. A common culprit is the home directory, which must be writable only by the user (mode 700 or 750 or 755) even if the user is alone in its group.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.