In my environment, actual .ssh directory exists on external device and links from it to `~/.ssh` with a symbolic link. Using `openssh` as client is working without problem, but `sshd` does not allow to authentication with public key inside it.

Is there any method to use `.ssh` directory on external device?

```
journalctl -u sshd

```

> 
> 
> ```
> Authentication refused: bad ownership or modes for directory /pool/secure/ssh
> 
> ```
> 
> 

### permissions

```
$ ls -ld ~/.ssh
lrwxrwxrwx. 1 foobar foobar 28 Mar  7 19:59 .ssh -> /pool/secure/ssh

$ ls -l /pool/secure/ssh
-rw-------  1 foobar foobar  381 Jun 29 15:01 authorized_keys
-rw-------  1 foobar foobar  292 Jun 29 15:01 config
-rw-------. 1 foobar foobar 5306 Jun 23 02:16 known_hosts

$ ls -ld /pool/secure/ssh
drwx------. 2 foobar foobar 8 Jun 29 15:01

```

### version

```
$ ssh -V       
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017

```

---

Added at 2017-06-29 (Tips)
--------------------------

* OpenBSD and FreeBSD can modify access permission of symlink by chmod. But Linux does not have system call doing that operation.
* stat(2) follow the link.
* [Base Specifications Issue 7](http://pubs.opengroup.org/onlinepubs/9699919799/functions/symlink.html) unspecified the value of the file mode bits returned in the st\_mode field.

Solved at 2017-06-30
--------------------

[auth\_secure\_path](https://github.com/openssh/openssh-portable/blob/c9cdef35524bd59007e17d5bd2502dade69e2dfb/auth.c#L542) have the answer. This function check permissions of file and directory, the range include parent directory. It continues to check if correct permissions (only owner can write) are set, until passing the home or root .

```
ex) general environment
/home/foobar/.ssh (raise error if group and other can write)
/home/foobar (same)
break!

ex) special environment (like me)
/home/foobar/.ssh -> /pool/secure/ssh
/pool/secure/ssh (raise error if group and other can write)
/pool/secure (same)
/pool (same)
/ (same)
break!

```