0

I have a use case where my program needs to read the id_rsa.pub file under /root/.ssh folder.

The default permissions for id_rsa.pub are (-rw-r--r--) and for .ssh folder they are (drwx------)

This is in line with the recommendations from the official SSH man page.

The problem:

Any group or a user cannot read the id_rsa.pub file because the parent folder (.ssh) does not have the execute permission on a group or a user.

  1. What would be the point of having of such a permission combination? No user or group can read the id_rsa.pub file without proper permissions on .ssh folder.
  2. Will there be any concerns with changing permissions for .ssh folder from 700 to 710? (to enable my program to read the id_rsa.pub file). This is also inline with the man page recommendations above.
4
  • In my experience the permissions for .ssh/ are drwx------ and the id_rsa.pub has -rw------- for the reasons you outline. No clue why you have the id_rsa.pub set to -rw-r--r-- since it could never be read by others anyway in .ssh/. Maybe you should clarify why you need a program that is not owned by you to have access to id_rsa.pub in .ssh/ to begin with? That said, id_rsa.pub is what one can share anywhere since it is the public key. My guess is it is just in .ssh/ for convenience. You should be able to just copy it to wherever you want for your application’s use. Jun 12, 2022 at 16:42
  • @Giacomo1968 I think 644 is normal on a public key eg it's mentioned here too gist.github.com/denisgolius/d846af3ad5ce661dbca0335ec35e3d39 and i think i might have seen that as a default after ssh-keygen
    – barlop
    Jun 12, 2022 at 17:22
  • 2
    Voting to close unless more details on the application are provided. The reason? This seems like an XY problem question. The premise is an application that is somehow not run by the user is supposed to somehow access the user’s .ssh/ directory when id_rsa.pub is the part of a key that can be publicly shared. It makes no sense to me unless a clear explanation can be provided as to why the application needs to behave this way. Jun 12, 2022 at 22:14
  • I would just place the pub key file somewhere that can be reached by non-root users (e.g. /whatever) and make symlinks anywhere (including /root/.ssh/) I need.
    – Tom Yan
    Jun 13, 2022 at 8:38

2 Answers 2

0

These permissions are hard-coded in OpenSSH. Keep in mind that you could run ssh-keygen from anywhere, saving keys to any writable location. By using these permissions, ssh-keygen makes sure the private key is protected anywhere.

If you have a program running that needs your public SSH key, it’s probably a good idea to just copy they public key elsewhere.

0

FWIW, the point of having a 644/664 access on the .ssh/id_rsa.pub file is to make it easy to be shared from there (its point of creation and reference). This access is based on the user umask setting.

You would normally make a hand-off copy to where-ever it is required. As a convenience and general rule the ssh-copy-id script should be used whenever possible to hand-off your public key to peers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .