The server accepts a key if it trusts the file the key is in. The file's mode and owner decide the login as much as the key itself.
sshd reads authorized_keys at every login. The StrictModes yes setting (on by default) makes it check the file and the directories above it: the owner must be the account itself or root, and nobody else may write to them. Otherwise any user on the machine could add their own key there and log in as deploy.
authorized_keys mode |
Key login |
|---|---|
-rw------- (600) |
works |
-rw-r--r-- (644) |
works |
-rw-rw-rw- (666) |
refused: everyone can write |
The server writes the reason for a refusal to its own log, which sudo journalctl -u lab-sshd --no-pager prints: bad ownership or modes. Fix the file from the start of the lesson and log in again:
No server restart is needed: it reads the file at the next login. Mode 777 "to make sure it can be read" does the opposite — others get write access, and the server refuses.
Key points
-
With
StrictModes yesthe server takes no keys from a file that someone besides its owner can change. -
The server writes the reason for a refusal to its log;
sshon the client does not show it.