On Nov 4 05:47, Matt D. wrote: > I mount with "noacl" as I don't need ACLs for my purposes and prefer to > leave everything up to Windows permissions. > > The problem with this is that ssh insists that ~/.ssh/config be less > permissive. But this file is bound to --rw-r--r-- for this option. > > Would it be appropriate to request ssh to ignore this requirement when > "noacl" present on the mounted volume?
Yes, in theory. However, this shouldn't be necessary.
Ssh already has code to check extrem perms only in "acl" mounted
directories, but it does not have this extra check for config files,
basically because it was never necessary:
If you use noacl, your file perms are faked to always be 644, or
444 if the DOS R/O bit is set, or 755/555 if executable/directory.
Additionally all files are faked as if they are owned by your own
account.
Ssh checks the config file like this:
if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
(sb.st_mode & 022) != 0))
fatal("Bad owner or permissions on %s", filename);
Which means, 0644 permissions are perfectly fine. As are 755 perms
for the ~/.ssh and ~ dirs.
I just mounted my home dir "noacl". The perms are as expected:
$ ls -ld . .ssh .ssh/config .ssh/id_local
drwxr-xr-x 1 corinna vinschen 0 Nov 4 12:27 .
drwxr-xr-x 1 corinna vinschen 0 Mar 14 2017 .ssh
-rw-r--r-- 1 corinna vinschen 703 Jan 19 2017 .ssh/config
-rw-r--r-- 1 corinna vinschen 7329 Jan 12 2017 .ssh/id_local
Note especially the too open perms in case of the private keyfile
"id_local". Still, I can ssh into one of my other machines just fine.
How come this doesn't work for you?
Corinna
--
Corinna Vinschen Please, send mails regarding Cygwin to
Cygwin Maintainer cygwin AT cygwin DOT com
Red Hat
signature.asc
Description: PGP signature
