StrictModes constraints on authorized_keys file permissions

Answer

When StrictModes yes is set, sshd will refuse to use an authorized_keys file if any of the following conditions are true:

• The ~/.ssh directory is writable by the group or others (i.e., its mode has any of the bits 022 set).
• The ~/.ssh/authorized_keys file is writable by the group or others (mode & 022 != 0).
• The owner of either the directory or the file is not the target user.

In practice this means the directory should be mode 700 (or at least 755 without group/other write) and the file mode 600 (or 644 without group/other write). Any additional write permission for group or other triggers a StrictModes violation.

Explanation

The daemon does not walk the entire path above the home directory; it checks only three objects: the user's home directory (the one that contains .ssh), the .ssh directory itself, and the authorized_keys file. If the home directory is group‑writable, sshd will also reject the key, but it does not inspect parent directories such as /home or the root.

Verification steps

1. Check current ownership and permissions: ls -ld ~ ~/.ssh ~/.ssh/authorized_keys
2. If any of the modes show group or other write (e.g., drwxrwxr-x or -rw-rw-r--), correct them:
• chmod 700 ~/.ssh
• chmod 600 ~/.ssh/authorized_keys
• chown $USER:$USER ~/.ssh ~/.ssh/authorized_keys
3. Restart the SSH daemon or simply try a new login; the existing session is not affected.

If after fixing the permissions you still see authentication failures, please provide the output of the ls -ld command above so we can confirm whether any higher‑level directory is unintentionally group‑writable.