SSH without password (shared home folder)

Question

I have a question about passwordless ssh with one home folder.

I have created a common /home/developers account, and multiple users (developerA,developerB ...). All developers have been delegated the same home folder (/home/developers).

As developerA on his machine, I have done the following:

1. ssh-keygen -t rsa -f developerA -C [email protected]
2. (on server). added the .pub to the server /home/developers/.ssh/authorized_keys file
3. ssh developerA@myServer -i developerA

I am thinking that the problem is linked to permissions, because the authorized_keys file is owned by developers (-rw------- 1 developers developers 2033 Nov 11 22:55 authorized_keys )

Does anyone have a solution to this problem, or how to go about multiple-user passwordless ssh without creating a home folder for each of them.

Thanks in advance guys

Answer 1

You only have one user. So it's not a multiple users problem. Make sure the .ssh directory has mode 700.

However, you're doing it wrong anyway. You should create different users for each developer and put them in a common group. If they need to work on the same files, you make them writable by their common group and put them in a directory that has the "set group ID" flag set, so whatever they write to it will belong to the group.

Answer 2

Since he asked, he must have his reasons. Here are some ideas:

1. Make sure that your public key string is not wrapped. It should be on one continuous line in authorized_keys.
2. Permissions should be rw-r-r (644) for authorized_keys.
3. Check permissions for ~/.ssh. Should be rwx-- (700).
4. Also make sure that /etc/ssh/sshd_config contains "PubkeyAuthentication yes".

Answer 3

In my experience, ssh is very particular about file and directory permissions. The authorized_keys file must be 'rw-r--r--' and the .ssh directory that contains it must also be accessible by everyone (but not writeable by world) This means the .ssh dictory, and the full directory path leading to it.

When you don't get this right, the key-exchange logins fail.

Mike

Answer 4

Password-less SSH login:

• generate a private/public key pair without a passphrase and put the public key in your authorized_keys file:

  ssh-keygen -t dsa -N ""
  cd .ssh/
  cat id_dsa.pub >> authorized_keys
  

Authorized_keys protection:

• authorized_keys file must only be readable by the user and the user's home directory can only be writable by the user:

  chmod go-rwx authorized_keys
  chmod go-w ~/
  

Answer 5

@joebob got it right! Just a few more details (notice his last line)

From this post you can see that SSH will refuse to use .ssh folder in a home directory that is shared. In my case, looking at /var/log/messages I see:

Mar 10 09:57:13 sshd[32249]: Authentication refused: bad ownership or modes for directory /home/

The referenced site has two solutions for this:

1. Fix permissions

   chmod g-w /home/your_user
   chmod 700 /home/your_user/.ssh
   chmod 600 /home/your_user/.ssh/authorized_keys
   

2. Set StrictModes off in your /etc/ssh/ssh_config (not recommend)

Unfortunately I am on a production box atm and I cannot test any of the solutions... I am also looking for a 3rd option if possible since due to our team setup I cannot change the home directory permissions... (bad model - I know)

Answer 6

Having many users with one home directory is a Very Bad Idea. Users will hate you and programs will hate you. Don't do that.