wolfsshd: add StrictModes permission/ownership checks for authorized_keys and host key

yosuke-wolfssl · yosuke-wolfssl · commit 25bd7c1ccd8a · 2026-06-09T14:58:06.000+09:00
diff --git a/apps/wolfsshd/auth.c b/apps/wolfsshd/auth.c
@@ -69,6 +69,7 @@
 
 #ifndef _WIN32
 #include <sys/types.h>
+#include <sys/stat.h>
 #include <pwd.h>
 #include <grp.h>
 #include <errno.h>
@@ -526,8 +527,153 @@ static int ResolveAuthKeysPath(const char* homeDir, const char* pattern,
     return ret;
 }
 
+/* OpenSSH "StrictModes" style permission/ownership check. Verifies that 'path'
+ * is not group or world writable. When 'checkOwner' is set the file (and any
+ * walked directory) must also be owned by 'uid' or by root. When 'checkChain'
+ * is set, each parent directory up to and including 'homeDir' is checked the
+ * same way (a writable ancestor directory would let an attacker substitute the
+ * file). When 'noReadOthers' is set (used for secret files such as the host
+ * private key) the file is also rejected if it is group or world readable.
+ *
+ * Public keys are not secret, so for authorized_keys we guard against write
+ * access (key injection) and enforce ownership by the user. For the host
+ * private key we guard against disclosure; ownership is not enforced there
+ * because the server may run privileged (e.g. via sudo) against a key owned by
+ * an unprivileged service account.
+ *
+ * Returns WS_SUCCESS when the path is considered safe. On platforms without
+ * POSIX ownership/mode semantics this is a no-op returning WS_SUCCESS. */
+int wolfSSHD_CheckFilePermissions(const char* path, const char* homeDir,
+        WUID_T uid, int checkOwner, int checkChain, int noReadOthers)
+{
+#ifndef _WIN32
+    int ret = WS_SUCCESS;
+    struct stat s;
+    char pathBuf[MAX_PATH_SZ];
+    char* slash;
+    word32 pathSz;
+    word32 i;
+
+    if (path == NULL) {
+        ret = WS_BAD_ARGUMENT;
+    }
+
+    /* check the target file itself. stat() (not lstat()) is used so symlinked
+     * key paths resolve to their target and are validated like OpenSSH, rather
+     * than being rejected outright. */
+    if (ret == WS_SUCCESS) {
+        if (stat(path, &s) != 0) {
+            wolfSSH_Log(WS_LOG_ERROR,
+                "[SSHD] Unable to stat %s for permission check", path);
+            ret = WS_BAD_FILE_E;
+        }
+        else if (!S_ISREG(s.st_mode)) {
+            wolfSSH_Log(WS_LOG_ERROR,
+                "[SSHD] %s is not a regular file", path);
+            ret = WS_BAD_FILE_E;
+        }
+    }
+    if (ret == WS_SUCCESS && checkOwner) {
+        if (s.st_uid != uid && s.st_uid != 0) {
+            wolfSSH_Log(WS_LOG_ERROR,
+                "[SSHD] Bad owner on %s, must be owned by the user or root",
+                path);
+            ret = WS_BAD_FILE_E;
+        }
+    }
+    if (ret == WS_SUCCESS) {
+        if ((s.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
+            wolfSSH_Log(WS_LOG_ERROR,
+                "[SSHD] %s is group or world writable", path);
+            ret = WS_BAD_FILE_E;
+        }
+    }
+    if (ret == WS_SUCCESS && noReadOthers) {
+        if ((s.st_mode & (S_IRGRP | S_IROTH)) != 0) {
+            wolfSSH_Log(WS_LOG_ERROR,
+                "[SSHD] %s is group or world readable", path);
+            ret = WS_BAD_FILE_E;
+        }
+    }
+
+    /* walk parent directories up to and including homeDir */
+    if (ret == WS_SUCCESS && checkChain && homeDir != NULL) {
+        pathSz = (word32)WSTRLEN(path);
+        if (pathSz >= MAX_PATH_SZ) {
+            ret = WS_BAD_FILE_E;
+        }
+        else {
+            WMEMCPY(pathBuf, path, pathSz);
+            pathBuf[pathSz] = '\0';
+
+            while (ret == WS_SUCCESS) {
+                /* trim the last path component to move up one directory */
+                slash = NULL;
+                for (i = 0; pathBuf[i] != '\0'; i++) {
+                    if (pathBuf[i] == '/') {
+                        slash = &pathBuf[i];
+                    }
+                }
+                if (slash == NULL) {
+                    break; /* no more parent directories */
+                }
+                if (slash == pathBuf) {
+                    pathBuf[1] = '\0'; /* parent is root "/" */
+                }
+                else {
+                    *slash = '\0';
+                }
+
+                if (stat(pathBuf, &s) != 0) {
+                    wolfSSH_Log(WS_LOG_ERROR,
+                        "[SSHD] Unable to stat directory %s", pathBuf);
+                    ret = WS_BAD_FILE_E;
+                    break;
+                }
+                if (!S_ISDIR(s.st_mode)) {
+                    wolfSSH_Log(WS_LOG_ERROR,
+                        "[SSHD] %s is not a directory", pathBuf);
+                    ret = WS_BAD_FILE_E;
+                    break;
+                }
+                if (checkOwner && s.st_uid != uid && s.st_uid != 0) {
+                    wolfSSH_Log(WS_LOG_ERROR,
+                        "[SSHD] Bad owner on directory %s", pathBuf);
+                    ret = WS_BAD_FILE_E;
+                    break;
+                }
+                if ((s.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
+                    wolfSSH_Log(WS_LOG_ERROR,
+                        "[SSHD] Directory %s is group or world writable",
+                        pathBuf);
+                    ret = WS_BAD_FILE_E;
+                    break;
+                }
+
+                /* stop after checking the home directory or filesystem root */
+                if (WSTRCMP(pathBuf, homeDir) == 0 ||
+                        WSTRCMP(pathBuf, "/") == 0) {
+                    break;
+                }
+            }
+        }
+    }
+
+    return ret;
+#else
+    WOLFSSH_UNUSED(path);
+    WOLFSSH_UNUSED(homeDir);
+    WOLFSSH_UNUSED(uid);
+    WOLFSSH_UNUSED(checkOwner);
+    WOLFSSH_UNUSED(checkChain);
+    WOLFSSH_UNUSED(noReadOthers);
+    return WS_SUCCESS;
+#endif
+}
+
 static int SearchForPubKey(const char* path, const char* authKeysFile,
-                           const WS_UserAuthData_PublicKey* pubKeyCtx)
+                           const WS_UserAuthData_PublicKey* pubKeyCtx,
+                           WUID_T uid, int strictModes)
 {
     int ret = WSSHD_AUTH_SUCCESS;
     char authKeysPath[MAX_PATH_SZ];
@@ -546,6 +692,19 @@ static int SearchForPubKey(const char* path, const char* authKeysFile,
         ret = rc;
     }
 
+    /* When StrictModes is enabled, refuse the authorized keys file if it or any
+     * parent directory up to the home directory is owned by another user or is
+     * group/world writable, mirroring OpenSSH. */
+    if (ret == WSSHD_AUTH_SUCCESS && strictModes) {
+        if (wolfSSHD_CheckFilePermissions(authKeysPath, path, uid, 1, 1, 0)
+                != WS_SUCCESS) {
+            wolfSSH_Log(WS_LOG_ERROR,
+                "[SSHD] Authorized keys file %s failed StrictModes check",
+                authKeysPath);
+            ret = WSSHD_AUTH_FAILURE;
+        }
+    }
+
     if (ret == WSSHD_AUTH_SUCCESS) {
         if (WFOPEN(NULL, &f, authKeysPath, "rb") != 0) {
             wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Unable to open %s",
@@ -705,7 +864,8 @@ static int CheckPublicKeyUnix(const char* name,
         }
 
         if (ret == WSSHD_AUTH_SUCCESS) {
-            ret = SearchForPubKey(pwInfo->pw_dir, authorizedKeysFile, pubKeyCtx);
+            ret = SearchForPubKey(pwInfo->pw_dir, authorizedKeysFile, pubKeyCtx,
+                pwInfo->pw_uid, wolfSSHD_ConfigGetStrictModes(authCtx->conf));
         }
     }
 
@@ -1049,7 +1209,8 @@ static int CheckPublicKeyWIN(const char* usr,
             if (ret == WSSHD_AUTH_SUCCESS) {
                 r[rSz-1] = L'\0';
 
-                ret = SearchForPubKey(r, authorizedKeysFile, pubKeyCtx);
+                ret = SearchForPubKey(r, authorizedKeysFile, pubKeyCtx, 0,
+                    wolfSSHD_ConfigGetStrictModes(authCtx->conf));
                 if (ret != WSSHD_AUTH_SUCCESS) {
                     wolfSSH_Log(WS_LOG_ERROR,
                         "[SSHD] Failed to find public key for user %s", usr);
diff --git a/apps/wolfsshd/auth.h b/apps/wolfsshd/auth.h
@@ -80,6 +80,9 @@ HANDLE wolfSSHD_GetAuthToken(const WOLFSSHD_AUTH* auth);
 int wolfSSHD_GetHomeDirectory(WOLFSSHD_AUTH* auth, WOLFSSH* ssh, WCHAR* out, int outSz);
 #endif
 
+int wolfSSHD_CheckFilePermissions(const char* path, const char* homeDir,
+    WUID_T uid, int checkOwner, int checkChain, int noReadOthers);
+
 #ifdef WOLFSSHD_UNIT_TEST
 #ifndef _WIN32
 extern int (*wsshd_setregid_cb)(WGID_T, WGID_T);
diff --git a/apps/wolfsshd/configuration.c b/apps/wolfsshd/configuration.c
@@ -89,6 +89,7 @@ struct WOLFSSHD_CONFIG {
     byte permitRootLogin:1;
     byte permitEmptyPasswords:1;
     byte authKeysFileSet:1; /* if not set then no explicit authorized keys */
+    byte strictModes:1; /* enforce file permission/ownership checks */
 };
 
 int CountWhitespace(const char* in, int inSz, byte inv);
@@ -218,6 +219,7 @@ WOLFSSHD_CONFIG* wolfSSHD_ConfigNew(void* heap)
         ret->port = 22;
         ret->passwordAuth = 1;
         ret->loginTimer = 120;
+        ret->strictModes = 1; /* on by default, matching OpenSSH */
     }
     return ret;
 
@@ -315,6 +317,7 @@ static WOLFSSHD_CONFIG* wolfSSHD_ConfigCopy(WOLFSSHD_CONFIG* conf)
             newConf->permitRootLogin        = conf->permitRootLogin;
             newConf->permitEmptyPasswords   = conf->permitEmptyPasswords;
             newConf->authKeysFileSet        = conf->authKeysFileSet;
+            newConf->strictModes            = conf->strictModes;
         }
         else {
             wolfSSHD_ConfigFree(newConf);
@@ -388,9 +391,10 @@ enum {
     OPT_TRUSTED_USER_CA_KEYS    = 21,
     OPT_PIDFILE                 = 22,
     OPT_BANNER                  = 23,
+    OPT_STRICT_MODES            = 24,
 };
 enum {
-    NUM_OPTIONS = 24
+    NUM_OPTIONS = 25
 };
 
 static const CONFIG_OPTION options[NUM_OPTIONS] = {
@@ -418,6 +422,7 @@ static const CONFIG_OPTION options[NUM_OPTIONS] = {
     {OPT_TRUSTED_USER_CA_KEYS,    "TrustedUserCAKeys"},
     {OPT_PIDFILE,                 "PidFile"},
     {OPT_BANNER,                  "Banner"},
+    {OPT_STRICT_MODES,            "StrictModes"},
 };
 
 /* returns WS_SUCCESS on success */
@@ -553,6 +558,31 @@ static int HandlePwAuth(WOLFSSHD_CONFIG* conf, const char* value)
     return ret;
 }
 
+/* returns WS_SUCCESS on success */
+static int HandleStrictModes(WOLFSSHD_CONFIG* conf, const char* value)
+{
+    int ret = WS_SUCCESS;
+
+    if (conf == NULL || value == NULL) {
+        ret = WS_BAD_ARGUMENT;
+    }
+
+    if (ret == WS_SUCCESS) {
+        if (WSTRCMP(value, "no") == 0) {
+            wolfSSH_Log(WS_LOG_INFO, "[SSHD] StrictModes disabled");
+            conf->strictModes = 0;
+        }
+        else if (WSTRCMP(value, "yes") == 0) {
+            conf->strictModes = 1;
+        }
+        else {
+            ret = WS_BAD_ARGUMENT;
+        }
+    }
+
+    return ret;
+}
+
 #define WOLFSSH_PROTOCOL_VERSION 2
 
 /* returns WS_SUCCESS on success */
@@ -1065,6 +1095,9 @@ static int HandleConfigOption(WOLFSSHD_CONFIG** conf, int opt,
         case OPT_BANNER:
             ret = SetFileString(&(*conf)->banner, value, (*conf)->heap);
             break;
+        case OPT_STRICT_MODES:
+            ret = HandleStrictModes(*conf, value);
+            break;
         default:
             break;
     }
@@ -1278,6 +1311,19 @@ int wolfSSHD_ConfigGetAuthKeysFileSet(const WOLFSSHD_CONFIG* conf)
     return ret;
 }
 
+/* returns 1 if StrictModes is enabled and 0 if not. Defaults to enabled (fail
+ * safe) when conf is NULL. */
+int wolfSSHD_ConfigGetStrictModes(const WOLFSSHD_CONFIG* conf)
+{
+    int ret = 1;
+
+    if (conf != NULL) {
+        ret = conf->strictModes;
+    }
+
+    return ret;
+}
+
 int wolfSSHD_ConfigSetAuthKeysFile(WOLFSSHD_CONFIG* conf, const char* file)
 {
     int ret = WS_SUCCESS;
diff --git a/apps/wolfsshd/configuration.h b/apps/wolfsshd/configuration.h
@@ -47,6 +47,7 @@ word16 wolfSSHD_ConfigGetPort(const WOLFSSHD_CONFIG* conf);
 char* wolfSSHD_ConfigGetAuthKeysFile(const WOLFSSHD_CONFIG* conf);
 int wolfSSHD_ConfigGetAuthKeysFileSet(const WOLFSSHD_CONFIG* conf);
 int wolfSSHD_ConfigSetAuthKeysFile(WOLFSSHD_CONFIG* conf, const char* file);
+int wolfSSHD_ConfigGetStrictModes(const WOLFSSHD_CONFIG* conf);
 byte wolfSSHD_ConfigGetPermitEmptyPw(const WOLFSSHD_CONFIG* conf);
 byte wolfSSHD_ConfigGetPermitRoot(const WOLFSSHD_CONFIG* conf);
 byte wolfSSHD_ConfigGetPrivilegeSeparation(const WOLFSSHD_CONFIG* conf);
diff --git a/apps/wolfsshd/test/run_all_sshd_tests.sh b/apps/wolfsshd/test/run_all_sshd_tests.sh
@@ -104,6 +104,40 @@ run_test() {
     fi
 }
 
+# Negative StrictModes check: a group/world readable host private key must make
+# wolfSSHd refuse to start when StrictModes is enabled (guards the wiring
+# between SetupCTX and wolfSSHD_CheckFilePermissions). Runs without sudo:
+# privilege separation is off and a high port is used, so no root is needed.
+run_strictmodes_negative_test() {
+    printf "StrictModes negative host key test ... "
+    # Use a relative host key path: wolfSSH log lines are capped at 120 chars,
+    # so a long absolute path would truncate the "failed StrictModes check"
+    # message this test greps for.
+    cp ../../../keys/server-key.pem strictmodes_hostkey.pem
+    chmod 644 strictmodes_hostkey.pem
+    cat <<EOF > sshd_config_test_strictmodes
+Port 22622
+StrictModes yes
+UsePrivilegeSeparation no
+HostKey strictmodes_hostkey.pem
+EOF
+    rm -f strictmodes_log.txt
+    # -D keeps wolfSSHd in the foreground; a StrictModes failure makes it exit
+    # rather than serve, so this returns on its own.
+    ../wolfsshd -D -d -f sshd_config_test_strictmodes -E strictmodes_log.txt
+    TOTAL=$((TOTAL+1))
+    if grep -q "failed StrictModes check" strictmodes_log.txt; then
+        printf "PASSED\n"
+    else
+        printf "FAILED!\n"
+        cat strictmodes_log.txt
+        rm -f strictmodes_hostkey.pem sshd_config_test_strictmodes strictmodes_log.txt
+        stop_wolfsshd
+        exit 1
+    fi
+    rm -f strictmodes_hostkey.pem sshd_config_test_strictmodes strictmodes_log.txt
+}
+
 # Run the tests
 if [[ -n "$MATCH" ]]; then
     if [[ " ${test_cases[*]} " =~ " $MATCH " ]]; then
@@ -147,6 +181,7 @@ else
         run_test "sshd_forcedcmd_test.sh"
         run_test "sshd_window_full_test.sh"
         run_test "sshd_empty_password_test.sh"
+        run_strictmodes_negative_test
     else
         printf "Skipping tests that need to setup local SSHD\n"
         SKIPPED=$((SKIPPED+3))
diff --git a/apps/wolfsshd/test/start_sshd.sh b/apps/wolfsshd/test/start_sshd.sh
@@ -3,6 +3,15 @@
 # starts up a sshd session, takes in the sshd_config file as an argument
 start_wolfsshd() {
     CURRENT_PIDS=`ps -e | grep wolfsshd | grep -oE "[0-9]+"`
+
+    # git cannot persist a 0600 file mode, so tighten any configured host key
+    # before launching. wolfSSHd refuses a group/world readable private key.
+    while read -r HOSTKEY; do
+        if [ -n "$HOSTKEY" ] && [ -f "$HOSTKEY" ]; then
+            chmod 600 "$HOSTKEY" || { echo "chmod 600 failed for host key: $HOSTKEY" >&2; return 1; }
+        fi
+    done < <(grep -E '^[[:space:]]*HostKey[[:space:]]+' "$1" | awk '{print $2}')
+
     # find a port
     sudo ../wolfsshd -d -E ./log.txt -f $1
 
diff --git a/apps/wolfsshd/test/test_configuration.c b/apps/wolfsshd/test/test_configuration.c
diff --git a/apps/wolfsshd/wolfsshd.c b/apps/wolfsshd/wolfsshd.c
