16.04.6 LTS OpenSSH-Server requires 0705 directory privileges for pubkey auth

[dundir]

Many servers are set up to simplify and centralize ssh key management within a single directory.

This is typically done with the line "AuthorizedKeysFile /somedir/%u". Much online discussion suggests placing the destination in /etc/ssh/authorized_keys/%u with 0700 on the authorized_keys folder and 0600 or 0644 on the separate public key-files, StrictTypes is enabled and is supposed to check for the 0700 and 0600 permissions... but doesn't appear to be working?.

The current supported version for SSH on 16.04.6 LTS appears to be:
OpenSSH_7.2p2 Ubuntu-4ubuntu2.7, OpenSSL 1.0.2g 1 Mar 2016

Under this configuration, standard key-based authentication is unable to complete without the key directory having at least 0705 on the directory, 0700 fails, and 0644 on the files is sufficient regardless.

This was tested on a 16.04.6 LTS release instance created on Linode.

[Paride Legovini (paride)]

Thank you for your report.

This looks like a local configuration problem: if /etc/ssh/authorized_keys is chmod 0700 non-root users can't reach their /etc/ssh/authorized_keys/%u directory. You probably want to chmod 0700 /etc/ssh/authorized_keys/%u.

Since we use this bug tracker to track bugs in Ubuntu, rather than configuration problems, I'm marking this bug as Invalid. This helps us to focus on fixing bugs in Ubuntu.

If you believe that this is really a bug, then you may find it helpful to read "How to report bugs effectively" http://www.chiark.greenend.org.uk/~sgtatham/bugs.html. We'd be grateful if you would then provide a more complete description of the problem, explain why you believe this is a bug in Ubuntu rather than a problem specific to your system, and then change the bug status back to New.