| Summary: | Warning message StrictModes=yes and $HOME has g+w | ||
|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | mkg |
| Component: | ssh | Assignee: | Assigned to nobody <unassigned-bugs> |
| Status: | CLOSED WONTFIX | ||
| Severity: | enhancement | CC: | djm, dtucker |
| Priority: | P5 | ||
| Version: | 7.7p1 | ||
| Hardware: | amd64 | ||
| OS: | Linux | ||
|
Description
mkg
2019-01-19 01:45:29 AEDT
We actually do almost exactly what you are describing (including -v) except that the message is only sent after authentication (eg via password) because we try not to leak any authentication information to unauthenticated users. Unfortunately since you didn't have any other method this didn't help you, but I don't see this as something that we should change, sorry. $ chmod 777 ~/.ssh $ ssh -v localhost [...] debug1: Offering public key: [...] debug1: Authentications that can continue: publickey,password,keyboard-interactive debug1: Next authentication method: password dtucker@localhost's password: [...] debug1: Remote: Ignored authorized keys: bad ownership or modes for directory /home/dtucker/.ssh Last login: Sat Feb 24 00:47:25 2018 from 127.0.0.1 [...] I agree with Darren here - we don't want to give this information to anyone who knocks on the front door; we can only give it to authenticated users and record it in the server's syslog. closing resolved bugs as of 8.6p1 release |