Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a question about passwordless ssh with one home folder.

I have created a common /home/developers account, and multiple users (developerA,developerB ...). All developers have been delegated the same home folder (/home/developers).

As developerA on his machine, I have done the following:

  1. ssh-keygen -t rsa -f developerA -C developerA@mycompany.com
  2. (on server). added the .pub to the server /home/developers/.ssh/authorized_keys file
  3. ssh developerA@myServer -i developerA

I am thinking that the problem is linked to permissions, because the authorized_keys file is owned by developers (-rw------- 1 developers developers 2033 Nov 11 22:55 authorized_keys )

Does anyone have a solution to this problem, or how to go about multiple-user passwordless ssh without creating a home folder for each of them.

Thanks in advance guys

share|improve this question

migrated from stackoverflow.com Nov 12 '12 at 9:09

This question came from our site for professional and enthusiast programmers.

2  
Shouldn't that be ssh developers@myServer -i developerA. If not, then you should flesh out the question a bit more. –  TomMD Nov 12 '12 at 0:15
    
Which problem (d'oh)? –  ShiDoiSi Nov 12 '12 at 8:51

5 Answers 5

Since he asked, he must have his reasons. Here are some ideas:

  1. Make sure that your public key string is not wrapped. It should be on one continuous line in authorized_keys.
  2. Permissions should be rw-r-r (644) for authorized_keys.
  3. Check permissions for ~/.ssh. Should be rwx-- (700).
  4. Also make sure that /etc/ssh/sshd_config contains "PubkeyAuthentication yes".
share|improve this answer
    
this unfortunately didn't work –  NeoDesign Nov 11 '12 at 23:02

In my experience, ssh is very particular about file and directory permissions. The authorized_keys file must be 'rw-r--r--' and the .ssh directory that contains it must also be accessible by everyone (but not writeable by world) This means the .ssh dictory, and the full directory path leading to it.

When you don't get this right, the key-exchange logins fail.

Mike

share|improve this answer
    
Nope. That's wrong and SSH will complain if the key is readable by anyone else other than the user that owns it. –  Nikos C. Nov 11 '12 at 22:28
    
@unbeli Nope. Here's my ~/.ssh: -rw------- 1 realnc users 223 Feb 28 2011 authorized_keys. Works like a charm. –  Nikos C. Nov 11 '12 at 22:33
    
Maybe its a question of which sshd server your using. I've used openssh and it has required the world-readable attribute. Weird you have different experience. –  mwalker Nov 11 '12 at 22:40
    
You two are talking about different files (authorized keys vs the users key in his .ssh directory) –  TomMD Nov 12 '12 at 0:20

You only have one user. So it's not a multiple users problem. Make sure the .ssh directory has mode 700.

However, you're doing it wrong anyway. You should create different users for each developer and put them in a common group. If they need to work on the same files, you make them writable by their common group and put them in a directory that has the "set group ID" flag set, so whatever they write to it will belong to the group.

share|improve this answer

Password-less SSH login:

  • generate a private/public key pair without a passphrase and put the public key in your authorized_keys file:

    ssh-keygen -t dsa -N ""
    cd .ssh/
    cat id_dsa.pub >> authorized_keys
    

Authorized_keys protection:

  • authorized_keys file must only be readable by the user and the user's home directory can only be writable by the user:

    chmod go-rwx authorized_keys
    chmod go-w ~/
    
share|improve this answer

Having many users with one home directory is a Very Bad Idea. Users will hate you and programs will hate you. Don't do that.

share|improve this answer
    
It would be helpful if you went into some more detail about the problems you allude to. –  frankster Oct 7 '13 at 12:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.