I have an .ssh/config with -rw-rw-r--. I know you're supposed to chmod 600. This is not my problem.

What I find confusing is that if I put the same config file somwhere else — say, ~/tmp/ssh_config — and then run ssh -F ~/tmp/ssh_config, the permissions are not checked! This happens on OSX.

Why's that? Why would SSH care about permissions in one location but not another?

  • 1
    Good question! You do not really need to move the file either, just specify ~/.ssh/config with the -F option and file permissions is not checked. – pkhamre Mar 30 '12 at 6:45
  • 1
    This really doesn't seem like the correct place for this question. Asking why a program was designed the way it was may need to be sent to the vendor. – Zoredache Mar 30 '12 at 7:44

If I were to take a guess at this, I would suggest that when the ssh client is using a configuration from the default locations, the user initiating the connection isn't really aware that a configuration file is being used. There is an implicit assumption that the config file hasn't been tampered with. If the permissions are too permissive, then that may mean the user is trusting the default config is safe, when it isn't.

When you reference a config file with the -F option, you are explicitly saying that you want that configuration file. You are basically telling the client, that you know what you want, and that configuration file is it. You have the responsibly to know what you are doing. There are valid use cases where a group of people might want to share a common configuration file for a set of common servers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.