up vote 0 down vote favorite
share [g+] share [fb]

I really know exactly know how to best ask this best and is taken care of in the backend, but I have recently delved into the world of public key authentication over ssh. This led me to wonder about how easy it would be for someone to do the same remotely to my computer? Is there a way to protect the .ssh folder to prevent scp into it or prevent a key from being added to authorized-keys without root permissions or something.

Is this type of security issue taken care of by the knowledge that they would have to have your password anyway to scp in? Am I dawning a tinfoil hat preemptively?

Thanks

link|improve this question
Why would someone need to authorize their key on your account when they have the password (except if password login suddenly gets prohibited -- I think it's possible, not sure though --, but then you should check the authorized_keys anyway)? In case of a problem, just change the password and clear out authorized_keys. They don't even need scp, just open an SSH connection and pipe an echo command into the file, or start vim, or any of a thousand ways to get the key in there... – Daniel Beck Apr 29 '11 at 16:58
feedback

1 Answer

up vote 0 down vote accepted

The standard protection mechanism is that the sshd on the server side denies access when any of the following conditions is not satisfied:

  • the protection on the authorized_keys in the .ssh folder is too liberal (0600 is expected).
  • the protection on the $HOME/.ssh folder is more than 0750.
  • the protection on $HOME is more than 0750
link|improve this answer
Nothing which cannot be corrected by logging in with a password. Except maybe owning one of the folders by root and being the only member of the group that has full permissions, but I'm not sure it's a good idea. – Daniel Beck Apr 29 '11 at 17:06
So if you wanted to deny scp to the .ssh folder you could chown it to 800 or something? would this mess up other settings? – cwieland Apr 29 '11 at 17:08
@cwieland, What I mean is that scp should not be able to access your authorized_key file unless impersonating root or yourself, in which case the remote client has already sufficient privileged access to your machine. Do you know of a workaround ? – Alain Pannetier Apr 29 '11 at 17:15
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.