SSH key generation / home directory

[GBR]

Good day,

Can any one tell me why when I change a users home directory on the client server that my password-less login doesn't work anymore? I have moved all the appropriate keys to the new home directory and have verified permissions are correct (I have also regenerated the keys to see if that was the problem). Does the .ssh directory always need to be in /home/user/? I'm trying to change the home directory of the user to /var/data/.

Thanks,
Greg

[Geoff Wild · Accepted solution]

Did you update the /etc/passwd file?

Also, /home is typically 755 but var is 555 - that could cause an issue...

Rgds...Geoff

[Denver Osborn]

What are permissions of /var/data, /var/data/.ssh and /var/data/.ssh/authorized_keys?

/var/data and /var/data/.ssh should be owned by the user and can't be group or world writable. (unless you setup sshd_config with 'StrictModes no' - wouldn't recommend it)

Check permissions.

-denver

[Steven Schweda]

"ssh -v [...]" might tell you something
about who is unhappy and why.

[GBR]

Folks, thanks.

After reading your comments, I spent some time really analysing the permissions. I had world writable permissions on the home directory.

# chmod 755 homeDir

This did the trick.

Greg

[Ralph Grothe]

Should make no difference, I would think,
if the dir containing the keys was in some other place, as long as the ownership and mode bits for this dir are secure in SSH's view.
But you may have to tell your ssh client where it will find the keys now,
and probably also where the known_hosts file can be found now (unless you run with -o stricthostkeychecking=no, but who wants to do that)

e.g.

$ ssh -l remote_user -i /var/data/id_rsa_something -o userknownhostsfile=/var/data/known_hosts remote_host remote_cmd

Please, look what the real filename of the *private* keyfile looks like.
This is what needs to be passed to -i or -o identityfile=/path/id_rsa_realname

Though it may work if you provide all the extra options,
using strange locations for ssh client's config makes things really awkward.