Solved SSH password login enabled after moving user to ZFS storage pool.

E

erik_w

Experimenting with ZFS and such, I found that password authentication is always allowed with sshing to a user in a ZFS pool.

From SSH and following the steps in the handbook under Ch. 20, ZFS, I create the pool, create the storage volume, change the mountpoint of the volume to /home/ and create the user's directory and give permissions.
Code: 
# zpool create storage raidz da0 da1 da2 da3
# zfs create -o (encryption options) storage/home
# zfs set mountpoint=/home storage/home
# zfs create storage/home/freebsd
# chgrp freebsd /home/freebsd
# chmod g+rwsx /home/freebsd

Exit and SSH back into freebsd@...

All volumes are mounted correctly. User freebsd's home directory is now /storage/home/freebsd.

I then import my key from the client machine, confirm it is in my -- now empty -- home directory, and then disable PasswordAuthentication in /etc/ssh/sshd_config on the test FreeBSD box, and logout of the session.

When I SSH back into freebsd, I am still prompted to type in the password, rather than being authenticated by the key.

Is this normal, or did I miss something during setup? I have been tinkering with it for over a day, and Internet search has found no result. It is as though when a user is in a ZFS pool, all directories outside of it are ignored. Since this is only a test box, I suppose I can try mounting all of / to the ZFS pool and report back. I just think this is odd the SSH rules are being ignored once a user is moved to ZFS.

FreeBSD version 13.0.
Raspberry Pi 4.
 
It's irrelevant the home directory is on ZFS or UFS.

Code: 
chgrp freebsd /home/freebsd
You only changed the group, the owner should also be set to the 'freebsd' user. Same for the permissions on the .ssh directory and the authenticated_keys file. chown -R freebsd:freebsd /home/freebsd

Code: 
chmod g+rwsx /home/freebsd
Why are you setting the SUID bit? Home directory permissions should be 0700, 0750 or 0755. Or if you want to allow other members of the group to write there, 0770 or 0775.
 
Perhaps I am tired. chown, yes.

So, yes, you are correct. #chown -R freebsd /home/freebsd does resolve this issue. I did not even think to check the permissions of nested files created by the user.

What also works: change the mountpoint of the ZFS directory to a directory in the user's home. ~/ .

Thank you, good Sir.
 
Yep, issues with SSH keys are almost always caused by bad or wrong permissions.
 
You must log in or register to reply here.
Back
Top