I was wondering today if there was a way to enforce a non root user to have a specific authorized_keys
file (among other sensible files). I came up with this solution.
- Disable
StrictModes
insshd_config
(got to manoeuvre with file ownership and stuff, andsshd
withStrictModes
active is very picky) Prevent the user from deleting files not owned by himself in his home directory with the sticky bit:
chown root:user /home/user
chmod 1770 /home/user
Every file and directory that should not be modified/removed should go through this:
chown root:user file_or_folder
chmod 0640 file_or_folder
chmod g+x folder
So far this approach seems to work. The user cannot modify/delete the files, and there's no risk that the user leaves his own home folder readable/writable (this seems to be the reason behind StrictModes
) because he does not own his home directory.
The question is: am I missing something? Can this be circumvented? Are there drawbacks?