#756930 ssh-add: display bad perm warning only if private key is owned by the same user

Package:
openssh-client
Source:
openssh
Description:
secure shell (SSH) client, for secure access to remote machines
Submitter:
Filippo Giunchedi
Date:
2014-08-03 16:36:07 UTC
Severity:
normal
#756930#5
Date:
2014-08-03 16:34:17 UTC
From:
To:
hi,
I noticed that ssh-add will display a warning: unprotected private key file and
refuse to add the private material only when trying to add material owned by
the same user calling ssh. However if the file is owned by another user but
nevertheless world readable, nothing is displayed and the key can be added.

in other words:

godog@i7:~$ ssh-add -l
The agent has no identities.
godog@i7:~$ cd /tmp/
godog@i7:/tmp$ ssh-keygen -f test_id
The key fingerprint is:
32:23:9e:da:84:8e:15:c6:e5:71:a6:f7:eb:30:25:99 godog@i7
godog@i7:/tmp$ chmod a+r test_id
godog@i7:/tmp$ ssh-add test_id
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for 'test_id' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
godog@i7:/tmp$ sudo chown nobody test_id
[sudo] password for godog:
godog@i7:/tmp$ ssh-add test_id
Enter passphrase for test_id:
Identity added: test_id (test_id)
godog@i7:/tmp$ ssh-add -l
2048 32:23:9e:da:84:8e:15:c6:e5:71:a6:f7:eb:30:25:99 test_id (RSA)
godog@i7:/tmp$