[Bug 1966591] [NEW] ssh-keygen -R changes known_hosts file permissions (mode)

[Evgeny Morozov]

Public bug reported:

When I use ssh-keygen -R to remove a host from known_hosts it changes
permissions on the file. This causes problems particularly when used on
the global known hosts file (/etc/ssh/ssh_known_hosts), because then
only root can read it. Programs running non-interactively as non-root
users suddenly fail to SSH and it's not immediately obvious why.

To reproduce:

$ ssh-keyscan github.com >test_known_hosts
$ chmod 741 test_known_hosts
$ ssh-keygen -R github.com -f test_known_hosts
$ stat test_known_hosts
...
Access: (0600/-rw-------) ...

Expected behavior: file permissions remain unchanged (mode 0741 in this
example).

$ lsb_release -rd
Description:	Ubuntu 18.04.6 LTS
Release:	18.04

$ apt-cache policy openssh-client
openssh-client:
  Installed: 1:7.6p1-4ubuntu0.6

** Affects: openssh (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1966591

Title:
  ssh-keygen -R changes known_hosts file permissions (mode)

Status in openssh package in Ubuntu:
  New

Bug description:
  When I use ssh-keygen -R to remove a host from known_hosts it changes
  permissions on the file. This causes problems particularly when used
  on the global known hosts file (/etc/ssh/ssh_known_hosts), because
  then only root can read it. Programs running non-interactively as non-
  root users suddenly fail to SSH and it's not immediately obvious why.

  To reproduce:

  $ ssh-keyscan github.com >test_known_hosts
  $ chmod 741 test_known_hosts
  $ ssh-keygen -R github.com -f test_known_hosts
  $ stat test_known_hosts
  ...
  Access: (0600/-rw-------) ...

  Expected behavior: file permissions remain unchanged (mode 0741 in
  this example).

  $ lsb_release -rd
  Description:	Ubuntu 18.04.6 LTS
  Release:	18.04

  $ apt-cache policy openssh-client
  openssh-client:
    Installed: 1:7.6p1-4ubuntu0.6

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1966591/+subscriptions