2
# rpm --query centos-release
centos-release-7-2.1511.el7.centos.2.10.x86_64

I want to use a common AuthorizedKeysFile in sshd for multiple users on my server. For that, I added:

Match Group my-secret-group
        AuthorizedKeysFile /etc/ssh/my-secret-group/common_authorized_keys

to /etc/ssh/sshd_config, and then added all those users to group my-secret-group.

sshd restarted fine, but that didn't allow me to log into accounts of the users in my-secret-group with a public key. However, when I set StrictModes no in /etc/ssh/sshd_config, it finally worked. I'm concerned that I shouldn't use StrictModes no, but I'm not sure what files should have what permissions for this setup to work. Currently, I have:

root:/etc/ssh/# ls -al my-secret-group/{.,common_authorized_keys}
-rw-r----- 1 root my-secret-group 2776 Nov  3 07:41 my-secret-group/common_authorized_keys

my-secret-group/.:
total 16
drwxrwx---  2 root my-secret-group   74 Nov  4 10:02 .
drwxr-xr-x. 3 root root            4096 Nov  4 10:33 ..
-rw-r-----  1 root my-secret-group 2776 Nov  3 07:41 common_authorized_keys
-rwxr-xr-x  1 root root            419 Nov  4 09:23 install_ssh_keys
-rw-r--r--  1 root root            274 Nov  3 07:47 README.md

Can I adjust permissions somehow so I don't have to set StrictModes no? I tried various combinations, but they didn't work.

1

You can use AuthorizedKeysCommand instead to get the authorized keys. This command does not need to confirm to these requirements (but you need to make sure the command is sane). For example

AuthorizedKeysCommand /usr/bin/cat /etc/ssh/my-secret-group/common_authorized_keys
AuthorizedKeysCommandUser root
# or whatever reasonable user with access to this file

should do the job.

  • Actually, I just tested it again and AuthorizedKeysCommand /usr/bin/cat /path/to/file is not correct either. sshd treats the whole line /usr/bin/cat /path/to/file as the name of a command, I can see that from an error message in /var/log/secure in my system. I had to create a script that calls cat /path/to/file and add AuthorizedKeysCommand /path/to/script to sshd_config. – jojman Nov 24 '16 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.