Bug ID 645589: Password-less ssh access lost for non-admin users after tmsh load sys ucs

Last Modified: Apr 10, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP TMOS(all modules)

Known Affected Versions:
11.5.1, 11.5.1 HF1, 11.5.1 HF10, 11.5.1 HF11, 11.5.1 HF2, 11.5.1 HF3, 11.5.1 HF4, 11.5.1 HF5, 11.5.1 HF6, 11.5.1 HF7, 11.5.1 HF8, 11.5.1 HF9, 11.5.2, 11.5.2 HF1, 11.5.3, 11.5.3 HF1, 11.5.3 HF2, 11.5.4, 11.5.4 HF1, 11.5.4 HF2, 11.5.4 HF3, 11.5.4 HF4, 11.5.5, 11.5.6, 11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4, 11.6.0 HF5, 11.6.0 HF6, 11.6.0 HF7, 11.6.0 HF8, 11.6.1, 11.6.1 HF1, 11.6.1 HF2, 11.6.2, 11.6.2 HF1, 11.6.3, 11.6.3.1, 11.6.3.2, 11.6.3.3, 11.6.3.4, 11.6.4

Fixed In:
11.5.7

Opened: Feb 16, 2017
Severity: 4-Minor

Symptoms

During the load of ucs, the $HOME/.ssh/authorized_keys file is moved to /etc/ssh/<user> and then a symbolic link is pointed to that file in the $HOME/.ssh such that the ucs load modification of ownership won't break the password-less ssh access to the BIG-IP. The problem is that the /etc/ssh/<user> directory has no other-group read permissions and non-admin users can't read the file and hence the password-less access is denied and a password is requested.

Impact

Non-admin users lose password-less access to their BIG-IP after tmsh load sys ucs.

Conditions

Always happens as the permissions for /etc/ssh/<user> are 0700 (user read-write-execute only) and it is owned by root.

Workaround

An admin user needs to manually change the permissions of the /etc/ssh and /etc/ssh/<user> permissions to be 0755. A non-admin user has no such capability and thus has no workaround.

Fix Information

By simply setting the umask to 0022 prior to the call to mkpath (with 0755 permissions) makes the /usr/local/bin/install_ucs.pm script behave as expected. The override of the umask is then set back to previous value as to not affect the script elsewhere.

Behavior Change