I've got a CentOS 7 server. I've set up /root/.ssh/authorized_keys on the host I'm trying to login to without a password. (Yes, allowing remote root access is a bad idea but this is an internal server.) ssh fails and there's this in the selinux audit log.
type=USER_LOGIN msg=audit(1494544798.597:481313): pid=18660 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="root" exe="/usr/sbin/sshd" hostname=? addr=xx.xx.xx.xx terminal=ssh res=failed'
Here are the permissions and context of the .ssh stuff:
# ls -aZ /root/.ssh drwx------. root root system_u:object_r:ssh_home_t:s0 . dr-xr-x---. root root system_u:object_r:admin_home_t:s0 .. -rw-------. root root system_u:object_r:ssh_home_t:s0 authorized_keys -rw-r--r--. root root unconfined_u:object_r:ssh_home_t:s0 known_hosts
I've compared the permissions and contexts to those of another system that allows ssh login without a password and they're the same.
In the audit message there's no indication of what file selinux is concerned about, just "res=fail".
In the system that works the log entry has this in it:
So, I'm confused. There is no file in /root/.ssh that has context system_u:system_r:sshd_t. So, I don't understand why that context is logged.
Is there a way to know what the context of all .ssh-related files should be? Yes, I've played with restorecon with no luck.