1

I have a question about passwordless ssh with one home folder.

I have created a common /home/developers account, and multiple users (developerA,developerB ...). All developers have been delegated the same home folder (/home/developers).

As developerA on his machine, I have done the following:

  1. ssh-keygen -t rsa -f developerA -C developerA@mycompany.com
  2. (on server). added the .pub to the server /home/developers/.ssh/authorized_keys file
  3. ssh developerA@myServer -i developerA

I am thinking that the problem is linked to permissions, because the authorized_keys file is owned by developers (-rw------- 1 developers developers 2033 Nov 11 22:55 authorized_keys )

Does anyone have a solution to this problem, or how to go about multiple-user passwordless ssh without creating a home folder for each of them.

Thanks in advance guys

  • 2
    Shouldn't that be ssh developers@myServer -i developerA. If not, then you should flesh out the question a bit more. – TomMD Nov 12 '12 at 0:15
  • 1
    Which problem (d'oh)? – ShiDoiSi Nov 12 '12 at 8:51
2

You only have one user. So it's not a multiple users problem. Make sure the .ssh directory has mode 700.

However, you're doing it wrong anyway. You should create different users for each developer and put them in a common group. If they need to work on the same files, you make them writable by their common group and put them in a directory that has the "set group ID" flag set, so whatever they write to it will belong to the group.

2

Since he asked, he must have his reasons. Here are some ideas:

  1. Make sure that your public key string is not wrapped. It should be on one continuous line in authorized_keys.
  2. Permissions should be rw-r-r (644) for authorized_keys.
  3. Check permissions for ~/.ssh. Should be rwx-- (700).
  4. Also make sure that /etc/ssh/sshd_config contains "PubkeyAuthentication yes".
  • this unfortunately didn't work – NeoDesign Nov 11 '12 at 23:02
1

In my experience, ssh is very particular about file and directory permissions. The authorized_keys file must be 'rw-r--r--' and the .ssh directory that contains it must also be accessible by everyone (but not writeable by world) This means the .ssh dictory, and the full directory path leading to it.

When you don't get this right, the key-exchange logins fail.

Mike

  • Nope. That's wrong and SSH will complain if the key is readable by anyone else other than the user that owns it. – Nikos C. Nov 11 '12 at 22:28
  • @unbeli Nope. Here's my ~/.ssh: -rw------- 1 realnc users 223 Feb 28 2011 authorized_keys. Works like a charm. – Nikos C. Nov 11 '12 at 22:33
  • Maybe its a question of which sshd server your using. I've used openssh and it has required the world-readable attribute. Weird you have different experience. – mwalker Nov 11 '12 at 22:40
  • 1
    You two are talking about different files (authorized keys vs the users key in his .ssh directory) – TomMD Nov 12 '12 at 0:20
1

Password-less SSH login:

  • generate a private/public key pair without a passphrase and put the public key in your authorized_keys file:

    ssh-keygen -t dsa -N ""
    cd .ssh/
    cat id_dsa.pub >> authorized_keys
    

Authorized_keys protection:

  • authorized_keys file must only be readable by the user and the user's home directory can only be writable by the user:

    chmod go-rwx authorized_keys
    chmod go-w ~/
    
0

@joebob got it right! Just a few more details (notice his last line)

From this post you can see that SSH will refuse to use .ssh folder in a home directory that is shared. In my case, looking at /var/log/messages I see:

Mar 10 09:57:13 sshd[32249]: Authentication refused: bad ownership or modes for directory /home/

The referenced site has two solutions for this:

  1. Fix permissions

    chmod g-w /home/your_user
    chmod 700 /home/your_user/.ssh
    chmod 600 /home/your_user/.ssh/authorized_keys
    
  2. Set StrictModes off in your /etc/ssh/ssh_config (not recommend)

Unfortunately I am on a production box atm and I cannot test any of the solutions... I am also looking for a 3rd option if possible since due to our team setup I cannot change the home directory permissions... (bad model - I know)

-2

Having many users with one home directory is a Very Bad Idea. Users will hate you and programs will hate you. Don't do that.

  • 1
    It would be helpful if you went into some more detail about the problems you allude to. – frankster Oct 7 '13 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.