Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know that sshd will refuse connection for bad ownership or modes for directory, but is there some other silent check and failure relating to the location of user's home directory? Or some configuration issue for that partition?

using CentOS release 6.3 (Final)

I'm trying to setup a new user, git, with a home directory on a large partition, but sshd seems to silently fail.

here's my sequence:

  1. add new user
  2. setup .ssh/authorized_keys with known public key
  3. ssh from remote host

If I setup the new user in /home/git, then everything works fine, but if I setup the user with a home folder on a different partition, then sshd seems to silently fail.

# userdel -r git
# useradd -m -d /home/git -c "Git Test" -s /bin/bash -g users git
# su -l git
# mkdir .ssh
# chmod 700 .ssh
# cp /tmp/authorized_keys .ssh

This works just fine, but if I change the useradd line to:

useradd -m -d /space/git -c "Git Test" -s /bin/bash -g users git

With LogLevel Verbose, the only message in auth log is:

Connection from XX.XX.XX.XX port 50774
Failed publickey for git from XX.XX.XX.XX port 50774 ssh2
Connection closed by XX.XX.XX.XX

Passing -vvv to ssh shows:

debug1: Offering public key: <USER>/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply

Update: showing ownership:

# ls -l /space/git
drwx------. 5 git  users 4096 Mar  7 17:43 .
drwxr-xr-x. 7 root root  4096 Mar  7 17:39 ..
drwx------. 2 git  users 4096 Mar  7 17:40 .ssh

Ownership on /home is identical

share|improve this question
    
What operating system and/or Linux distribution? –  Michael Hampton Mar 7 '13 at 18:03
    
CentOS release 6.3 (Final) –  libjack Mar 7 '13 at 18:12
    
What's the ownership and permissions of /space/git and /space? –  mgorven Mar 7 '13 at 18:15
2  
Did you set up your SELinux contexts properly for the directory? –  Michael Hampton Mar 7 '13 at 18:30
1  
Hmm, perhaps not! ... ls -laZ for /space/git is different than /home/git. Will explore.. –  libjack Mar 7 '13 at 19:00
show 2 more comments

1 Answer

up vote 2 down vote accepted

You created a user home directory outside of /home, and so SELinux, knowing nothing about your intentions, denied access to it.

To resolve the issue, set a permanent SELinux context for the home directory and then relabel the files.

semanage fcontext -a -t user_home_t "/space/git(/.*)?"
restorecon -r -v /space/git

(BTW, /srv is the preferred directory for such things, rather than /space.)

share|improve this answer
    
Complete! Thanks again. –  libjack Mar 7 '13 at 19:18
    
If I had checked /var/log/audit, I would have seen the failure message. –  libjack Mar 7 '13 at 19:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.