[Bug 2713] New: Please provide a StrictModes-like setting (command line parameter) for ssh (client)

[bugzilla-daemon at bugzilla.mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=2713

            Bug ID: 2713
           Summary: Please provide a StrictModes-like setting (command
                    line parameter) for ssh (client)
           Product: Portable OpenSSH
           Version: 7.5p1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: sascha-openssh-bugs at silbe.org

Background: We're using rsync over ssh to mirror a directory tree to a
set of remote servers, with rrsync as a forced command on the server
side to restrict access to the target directory. An entire group of
people as well as an automated process using a separate user account
need to be able to perform the transfer. Some of the people involved
also have unrestricted access. Because rrsync uses the target directory
as the root of the accessible hierarchy, the paths to use for
restricted and unrestricted access are different. So it makes a whole
world of difference which private key is chosen.

The very strict "only the user may be able to read the private key
file" check hurts us quite a bit here. It's also OpenSSH enforcing its
own policy that doesn't match our threat model at all. sshd has a way
to explicitly disable those checks (StrictModes no) for
authorized_keys, but the _client_ (of all things) refuses to load
private keys that are group-readable (but not world-readable) with no
way to tell it that, yes, this is exactly what we want and need.

We're currently using the work-around of running "ssh-add - <
foo/id_rsa", but that's just that: a work-around. Besides other things
it requires ssh-agent to be running.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.