Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to SSH from my local machine to my server. In the past I haven’t had to enter a password because my public key was on the server in authorized_keys. However, today I think some permissions have been changed on some files and it’s asking for a password every time I try to SSH.

What are the correct/default permissions for the .ssh folder and its contents on my local machine/server?

Here are my current permissions

My server

[root@server9987 .ssh]# ls -la
total 24
drwx------ 2 root root 4096 Oct 17 03:29 .
drwxr-x--- 7 root root 4096 Oct 17 03:29 ..
-rw------- 1 root root  397 Oct 16 19:11 authorized_keys
-rw------- 1 root root 1675 Oct 12 02:10 id_rsa
-rw------- 1 root root  398 Oct 12 02:10 id_rsa.pub
-rwxrwxrwx 1 root root  830 Oct 17 03:29 known_hosts

My local machine

➜  .ssh  l
total 32
drwx------  6 Oliver  staff   204 17 Oct 00:28 .
drwxr-xr-x  7 Oliver  staff   238 16 Oct 17:28 ..
-rw-------  1 Oliver  staff   332 16 Oct 17:28 config
-rw-------  1 Oliver  staff  1766 13 Jul 11:13 id_rsa
-rw-------  1 Oliver  staff   398 13 Jul 11:13 id_rsa.pub
-rw-------  1 Oliver  staff  3312 17 Oct 00:28 known_hosts
share|improve this question
3  
known_hosts should not be group writable or world writable. –  David Schwartz Oct 17 '12 at 0:34

2 Answers 2

You want the private key to be readable by the owner alone. It's generally a good idea to make everything in that folder readable and writable only by the owner. However, the file which allows others to login via a key must be readable by the user who is running the ssh daemon.

generally:

find ~/.ssh -type f -exec chmod 600 {} \;
chmod 755 ~/.ssh
chmod 644 ~/.ssh/authorized_keys

Update Default permissions for the ~/.ssh folder are 700 (openssh 5.9, gentoo) and some files:

$ ll .ssh; ll -d .ssh
-rw-r--r-- 1 jaroslav jaroslav 406 Oct 17 04:32 known_hosts
drwx------ 2 jaroslav jaroslav 4096 Oct 17 04:32 .ssh
-rw------- 1 jaroslav jaroslav 1766 Oct 17 04:37 id_rsa
-rw------- 1 jaroslav jaroslav  395 Oct 17 04:37 id_rsa.pub

This is after moving my original .ssh away and running ssh hostname.org; ssh-keygen. The files created by the openssh commands seem to be unaffected by umask

So I'm still right, and the comments/down-votes have nothing on my answer :'(.

The reason why .ssh can be 700 is because sshd is mostly run by root who can read whatever she wants no matter what. The reason sshd is mostly run by root is because the daemon needs to listen on a privileged port (<1024).

share|improve this answer
    
Ha, ha, ha. Why the down-vote? This is a correct answer! Anyway, I've gone to some length to explain what chmod means over at SO. for anyone interested: stackoverflow.com/questions/11995894/… –  Ярослав Рахматуллин Oct 17 '12 at 1:13
    
It is a good answer, and more often than not, is the correct answer for most problems like this. However, it just happened to not be the exact answer for this particular situation. Or at least missed one problem if there is more than one (the information shown by asker is not complete). (хороший аватар) –  Skaperen Oct 17 '12 at 2:15
    
Thank you for your answer. However, I’m still being asked for a password. If the permissions are right, any other ideas what might be causing this? –  Oliver Joseph Ash Oct 17 '12 at 13:53
    
Yes. 1 - Pam is not properly configured (weird because it was before). 2 - PubkeyAuthentication, AuthorizedKeysFile, UsePAM not properly set in /etc/ssh/sshd_config. 3 - your public key is not in ~/.ssh/authorized_keys of the target user. 4 - your ~/.ssh/id_[rd]sa is not the one that is added to autorized_keys on the target. 5 - .ssh/known_hosts has a mismatching fingerprint for server (wild guess, should only be a warning). –  Ярослав Рахматуллин Oct 17 '12 at 15:37
    
It’s not 3 or 4 because I have verified both of those. Even tried generating a new key and replacing authorized_keys with that, to no avail still. Also tried deleting known_hosts on my local machine to let it re-generate itself. It must be 1 or 2, but I’ve no idea what Pam is! –  Oliver Joseph Ash Oct 18 '12 at 15:05
up vote 0 down vote accepted

Found the answer over in this thread. It wasn’t the permissions on the SSH files/folders, rather it was the permission of the user directory.

share|improve this answer
1  
That is also a requirement, yes. When you have an issue like you have, check the log file for sshd. Usually this is kept in /var/log/secure. More infrequently, /var/log/auth.log. Rarely in /var/log/syslog or /var/log/messages. They usually tell you right off the bat what the problem is with you logging in. –  UtahJarhead Oct 18 '12 at 20:44
    
Gotta admit I never had the issue where my home folder was writable by others, so I wasn't even considering that. You live, you learn :D –  Ярослав Рахматуллин Oct 19 '12 at 0:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.