3

Is it possible to allow one user to connect via SSH when that user's home directory is g+w?

As I understand it, I can allow this if I set StrictModes no in /etc/ssh/sshd_config, but that would mean every other user would be able to move anyone else's ~/.ssh.

Are there any other ways to do this?

A previous server was set up with the user's home directory as a+w, but public key ssh was still possible. Its sshd_config also had StrictModes yes, so I suspect there must be some way to do this.

Currently, the user can login over public key ssh when the home directory is 700, but if I change that to any other group-writable value, he cannot.

4
  • I don't know if it would placate SSH, but you could try setting the sticky bit on the home directory. Then only the owner of a file/subdirectory can remove it.
    – Barmar
    Feb 9, 2016 at 18:20
  • Why do you allow group write on the home directory in the first place? Why not create a subdirectory that everyone in the group can write to, instead of doing it to the home directory itself?
    – Barmar
    Feb 9, 2016 at 18:21
  • in classic RHEL every user gets their own "user private group"
    – chicks
    Feb 9, 2016 at 18:46
  • @Barmar (stupid typo -- I meant a+w); The reason is that the people who set up the last server put it into this configuration (but there are no notes). I wanted to keep it this way because a 3rd party connects via this account and (apparently) it took a long time on both sides to get the system working. If I make them go though this a second time, I'll just end up burning bridges.
    – Andrew
    Feb 10, 2016 at 1:16

1 Answer 1

2

Setting StrictModes no in /etc/ssh/sshd_config is what you are looking for. From the man page on CentOS 6.7. I hope your version is compatible.

 StrictModes
         Specifies whether sshd(8) should check file modes and ownership
         of the user’s files and home directory before accepting login.
         This is normally desirable because novices sometimes accidentally
         leave their directory or files world-writable.  The default is
         “yes”.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .