Bug 1532 - SSH ignoring "StrictModes no"
Summary: SSH ignoring "StrictModes no"
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sftp-server (show other bugs)
Version: 5.1p1
Hardware: ix86 Linux
: P3 normal
Assignee: Assigned to nobody
URL: http://www.networksecurityarchive.org...
Keywords:
Depends on:
Blocks: V_5_4
  Show dependency tree / graph
 
Reported: 2008-10-25 08:53 AEDT by Marko Štamcar
Modified: 2010-03-26 10:50 AEDT (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marko Štamcar 2008-10-25 08:53:25 AEDT 
I'm posting a bug another user described so well I don't think I need to write my own description:

We have a very strange problem with SSH. It looks like sshd is ignoring
"StrictModes no" and still doing strict permission checking.
Can anyone give me some hint what the problem might be?

Problem:
As long as the various users directory (e.g. User XA302) is mode drwxr-sr-x
everything is fine. But if I change this to drwxrwsr-x SSH complains
"Authentication refused: bad ownership or modes for directory
/appl/chroot/cp/XA302". We need group write permission on /appl/chroot/cp/...
for our jobs which do further processing of the transfered files.
So I set "StrictModes no" in sshd_config. 
Does anyone have a similar problem or knows why SSH might possibly ignore
"StrictModes no"?
Comment 1 Damien Miller 2009-01-21 21:47:07 AEDT 
I can't replicate this. Please send a debug trace from the server ("sshd -ddd") failing to authenticate.
Comment 2 Damien Miller 2009-02-14 15:07:12 AEDT 
Hang on, are you talking about ChrootDirectory or authorized_keys?
Comment 3 Marko Štamcar 2009-02-15 02:07:13 AEDT 
We're talking about ChrootDirectory and the "new" internal-sftp feature in SSH.
Comment 4 Damien Miller 2009-02-15 17:45:12 AEDT 
StrictModes does not apply to ChrootDirectory.
Comment 5 zerbaugh 2009-07-02 00:43:58 AEST 
"StrictModes does not apply to ChrootDirectory."

Is that the intended behavior, or just the current state of things? It seems at odds with the man page, which states:

"StrictModes: Specifies whether sshd(8) should check file modes and ownership of the user's files and home directory before accepting login."
Comment 6 Damien Miller 2009-11-10 14:00:18 AEDT 
This is intentional, see https://bugzilla.redhat.com/show_bug.cgi?id=522141 for what happens when the checks are relaxed.

I have updated the manpage to clarify this.
Comment 7 Darren Tucker 2010-03-26 10:50:46 AEDT 
With the release of 5.4p1, this bug is now considered closed.