SSH to a server having /home on a RAID

Ask Fedora
,
1

Hi,

After dnf-auto-update on 26th August 2026 I started to experience problems in SSHing into my server. It ignores the publickey and falls back to password login. Once I login, I get a message:

Could not chdir to home directory /home/username: Permission denied

Then and I end up in the root directory. Once there, I can, however, cd into my home directory which is on a RAID.

I added a foobar user with home being away from the RAID mount somewhere in /var/lib.
Then I added my pub key to that user’s authorized_keys -file and managed to login successfully without password prompt. If I move that foobar user’s home under /home, the RAID partition, it falls back to password login. If I move the home directory back to /var/lib, key based login works again.

I’ve set up sshd to debug3 level logging and I get two lines relating to the key exchange:

debug3: mm_answer_keyallowed: publickey authentication test: 
    ED25519 key is not allowed
Failed publickey for username from 192.168.1.62 port 65093 
    ssh2: ED25519 SHA256:[CORRECT KEY FINGERPRINT HERE]

Does anyone have an idea what could cause the issue here?

I’ve checked the RAID status with mdadm -D /dev/md127 & cat /proc/mdstat and both state the array is OK.

My .ssh directory’s mode bits are 0700, and authorized_keys within it 0600.

I’m thinking something in the latest autoupdate broke something, since I’ve not done any changes to the server manually between 24th (the previous successful key based login) and yesterday, the 26th.

3

Thanks for the tip. After setenforce 0 I can login with key. Not going to leave that in permissive mode, though :slight_smile:

As for the namei:

f: /home/juruotsa/.ssh/authorized_keys
dr-xr-xr-x root     root     system_u:object_r:root_t:s0  /
drwxr-xr-x root     root     system_u:object_r:home_root_t:s0  home
drwxr-xr-x juruotsa juruotsa system_u:object_r:unlabeled_t:s0  juruotsa
drwx------ juruotsa juruotsa unconfined_u:object_r:ssh_home_t:s0  .ssh
-rw------- juruotsa juruotsa unconfined_u:object_r:ssh_home_t:s0  authorized_keys

I also check the audit log, and there is a denial entry related to SSH and the partition on RAID:

type=AVC msg=audit(27/08/26 12:06:18.007:829) : avc:  
  denied  { search } for  pid=164916 
  comm=sshd-session name=juruotsa dev="md127p1" ino=70778973 
  scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 
  tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0

I have no clue as to what that means.

5

A good question(Arthur’s now deleted post above). I have no recollection of adding/enabling/installing systemd-ssh-proxy. If it is installed by default, then yes, I’m using it.

The audit log entry led me to a path at the end of which was a tip: restorecon -R /home/username. I ran that against my home directory and now SSH with keys work again.

6

It is installed with the systemd packages. It is always enabled but most likely not used.

When switching to tty4 you get a line like “Try connecting to…”.

Screenshot_2026-08-27_11-59-13

That comes from the systemd ssh proxy.