openssh unix dev - Jun 2015 - how to have ssh not disable local security policy?

It seems something changed (maybe I'm missing a patch)
to turn off this message:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0650 for '/root/.ssh/id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.

It isn't.  The other permissions are controlled by the right
most digit which is 0.  Each user -- including root,
is in their own group, so allowing groups access to
be the same as user access is policy.

By forcing this protection on my setup, I can't
have the same home directory for my local and domain
users even though they are the same on the server.

But on the win-machine with home mounted directories,
it messes things up and people have to come up with
insecure work-arounds.  Group permissions != "others".

I did set the strictmodes to 'no', in the sshd_config
file... but I don't see a similar parameter in the
ssh file.  Am I missing something?

Thanks!

On 03/06/15 23:10, L. A. Walsh wrote:
> It seems something changed (maybe I'm missing a patch)
> to turn off this message:
(...)
> Each user -- including root, is in their own group, so allowing groups 
> access to
> be the same as user access is policy.
>
> By forcing this protection on my setup, I can't
> have the same home directory for my local and domain
> users even though they are the same on the server.
>
> But on the win-machine with home mounted directories,
> it messes things up and people have to come up with
> insecure work-arounds.  (...)  Am I missing something?
You need to apply 
https://sources.debian.net/src/openssh/1:6.7p1-6/debian/patches/user-group-modes.patch/

I was convinced it was available as a ./configure switch but turns out 
it isn't upstreamed.
Darren, Damien could you reconsider the decision of not accepting this 
relatively common patch? After reading the discussion at 
https://bugzilla.mindrot.org/show_bug.cgi?id=1060 I also think there was 
a misunderstanding from your part.

I have reviewed the patch (note it is an improved version than the one 
submitted in the bug) and it seems suitable for inclusion.
I recommend however to add a setpwent() just before the getpwent() loop, 
to protect against the possibility of some library calling getpwent() 
before secure_permissions().