Key-based login to web01 fails and the server's log records: `Authentication refused: bad ownership or modes for directory /home/dev/.ssh`. Which fix is the right one?
LPIC-1 Exam 102-500, objective 110. Security hard
Draft — not checked yet. This question was written from the published exam objectives and cites the clause it comes from, but nobody has yet read it against that clause and signed for it.
It is kept out of search results and out of mock exams until they have. Read the source below before you take the answer as settled.
The options
Not correct chmod 777 /home/dev/.ssh
Wrong, and it makes the failure permanent. sshd rejects the directory precisely because it is group- or world-writable; 777 is the most writable mode there is.
Correct chmod 700 /home/dev/.ssh and chmod 600 /home/dev/.ssh/authorized_keys, with both owned by dev.
Correct. sshd requires that ~/.ssh and authorized_keys be owned by the user (or root) and not writable by group or others. The home directory itself must also not be group- or world-writable.
Not correct chmod 644 ~/.ssh/id_ed25519 on the laptop.
Wrong twice over. The message concerns a directory on the server, not the client's key, and making a private key world-readable causes ssh to refuse to use it with 'UNPROTECTED PRIVATE KEY FILE'. Private keys belong at 600.
Not correct Set `StrictModes yes` in /etc/ssh/sshd_config and restart sshd.
Wrong. StrictModes yes is already the default and is the very check producing this message. Setting it to no would silence the complaint while leaving the insecure permissions in place.
Why
sshd's StrictModes check exists because a world-writable ~/.ssh lets any local user append their own key to authorized_keys and become you. The conventional layout is home directory 755 or stricter, ~/.ssh 700, authorized_keys 600, private keys 600 and public keys 644. This failure is silent on the client, which simply falls back to the next authentication method and asks for a password, so the server log is the only place the reason appears.
Where this comes from
- Cited
- manual page sshd(8)
- What it says
- StrictModes checks file modes and ownership of the user's files and home directory before accepting login.
Practise this
Reading one question is not practice. The trainer will draw a set from objective 110 and space the ones you get wrong.