23

This is so wierd. Logged in to a Linux (RHEL) box as a user 'g', doing an ls -lah shows

drwxrwxrwx 6 g    g    4.0K Jun 23 13:27 .
drwxrw-r-x 6 root root 4.0K Jun 23 13:15 ..
-rwxrw---- 1 g    g     678 Jun 23 13:26 .bash_history
-rwxrw---- 1 g    g      33 Jun 23 13:15 .bash_logout
-rwxrw---- 1 g    g     176 Jun 23 13:15 .bash_profile
-rwxrw---- 1 g    g     124 Jun 23 13:15 .bashrc
drw-r----- 2 g    g    4.0K Jun 23 13:25 .ssh

So the user 'g' in group 'g' /should/ be able to read and write to the .ssh directory but if I do ls -lah .ssh/ I get ls: .ssh/: Permission denied. I also get Permission denied if I try and cat any files in the directory

If I go in as root and change the permissions to 700, 744, 766 or anything as long as the 'user' permission is 7 it works and I can CD and LS the directory and files within.

id g returns

uid=504(g) gid=506(g) groups=506(g)

Edit:

I've copied these permissions exactly to another identical box and there is no issue. I can cd into a directory without execute permissions.

5 Answers5

42

The directory will require the execute bit set in order for you to enter it. I don't know what you tested, but you cannot enter a directory without the execute bit, or read files in it:

$ mkdir foo
$ echo "baz" > foo/bar
$ chmod 660 foo
$ cd foo
bash: cd: foo: Permission denied
$ cat foo/bar
cat: foo/bar: Permission denied

That is, unless your process has the CAP_DAC_OVERRIDE POSIX capability set (like root has), which allows you to enter directories without the executable bit set, iirc.

Basically, you should try to keep you .ssh directory at 700, and everything in it at 600, just to be safe. The ssh man page gives per file instructions on the required ownerships and permission modes for files in ~/.ssh.

wzzrd
  • 10,409
  • 2
  • 35
  • 47
24

A directory requires execute permission in order to cd into it. This is the behavior that is expected.

chmod +x /path/to/dir/
Nassim
  • 205
  • 2
  • 6
Grahamux
  • 632
  • 3
  • 6
  • But I also cannot `cat` any files in the directory with the same permissions, they shouldn't need execute permissions to read –  Jun 23 '11 at 13:37
  • 5
    You need execute permissions on the directory to access anything inside a directory. This answer is correct. – EightBitTony Jun 23 '11 at 13:41
  • 1
    @samarudge Consider `x` on a directory to give you permission to "be in" that directory. Without it, you cannot cd to the directory, you can't see what's in the directory, you can't open whats in the directory. If you don't have permission to be in the library, you cannot read the books there. – DerfK Jun 23 '11 at 13:44
  • If I add execute permissions to the directory (744 to the directory, 644 to the files inside) I get an error from SSHD saying the permissions of the .ssh directory must be 644 or lower. But with the permissions as 644 it says it can't access .ssh/authorized_keys –  Jun 23 '11 at 13:44
  • *It does specifically say '.ssh/ directory', not the files –  Jun 23 '11 at 13:45
  • @samarudge, see my answer below: ssh is picky about what permissions can be on .ssh directories. The problem is not the 7 in 744, but the second 4. The 'other' group should not be able to read you .ssh directory. – wzzrd Jun 23 '11 at 14:31
3

In order to ls or cd into a directory, you need execute permissions. While you don't have them, you can not really inspect the content and see the permissions of the files inside, so most probably the file permissions are wrong themselves, if you can not cat them.

Directory permission of 700 and file permissions 644 are perfectly OK setup for me.

Sunny
  • 5,834
  • 3
  • 22
  • 24
  • The permissions for the files are `644`, the owner of the files is g:g so the permissions of the files are correct. If I add execute permissions to the directory SSHD says I need to drop the permissions to 644 or under –  Jun 23 '11 at 13:49
  • Sunny's comments are correct - down vote a bit harsh – AndyM Jun 23 '11 at 14:09
0

I take it this is a an ssh file issue now ? not a general chmod issue ?

If so try 

$chmod go-w ~/
$chmod 700 ~/.ssh
$chmod 600 ~/.ssh/*
$chmod 600 ~/.ssh/.*
AndyM
  • 948
  • 2
  • 16
  • 26
  • another issue , could be the mount point , is it mounted from somewhere else, CIFS, NFS ? – AndyM Jun 23 '11 at 14:14
0

Directories need x bit set (for directory that bit is seen as search bit) to open. So I use tree so I can get only the folder set and avoid the nightmare of having all the files set as executables ( the option for tree is -d List directories only.):

sudo tree -faid here_goes_your_directory xargs -L1 -I{} sudo chmod 755  "{}"

Warning!!! you should have this into considerations:

  • using chmod or chown recursive on root / directory or system directories will destroy your OS (actually anything recursive on / directory or system directories is dangerous)

  • this is not a good security practice to set permission bulk like that

Eduard Florinescu
  • 851
  • 5
  • 24
  • 39