Possible packaging issue: CA .txz owns / and /usr as the build user, breaks root SSH (StrictModes) Up front: I'm a basic Unraid user and didn't diagnose this myself — I lean on an AI assistant (Claude) that did the digging. I'm just passing along what it found. If something's wrong or you want more detail, tell me what to run and I'll paste it. After a recent Community Applications update, root SSH by key stopped working — every key rejected with "Permission denied". The server log showed: sshd-session: Authentication refused: bad ownership or modes for directory / sshd-session: Failed publickey for root ... The key was fine and still in authorized_keys. It traced to the ownership of / itself: # ls -ld / /usr drwxr-xr-x 20 501 games ... / drwxr-xr-x 1 501 games ... /usr / and /usr were owned by UID 501 / GID 20 (games) instead of root:root. sshd's StrictModes (on by default) won't read authorized_keys if any directory up the path — like / — isn't root-owned, so it rejects every root key. The 501:games comes from the CA package. Every entry in the .txz is owned by the build user, including the top-level directories that overlap the host: # tar tvf community.applications-2026.07.11-x86_64-1.txz | grep -v ' root/root' drwxr-xr-x andrewzawadzki/staff 0 2026-07-11 00:25 ./ drwxr-xr-x andrewzawadzki/staff 0 2026-07-11 00:25 ./usr/ ... (all 60 entries are andrewzawadzki/staff) andrewzawadzki = UID 501 and staff = GID 20 on a Mac; on Unraid there's no UID 501 and GID 20 is games. Since upgradepkg runs as root and preserves the archived ownership, installing ./ and ./usr/ re-owns the live / and /usr to 501:games. Plugins reinstall from flash at every boot and on each update, so it re-applies. This got me back in (just the two directory inodes; run it from the webUI/console Terminal since SSH is down): chown root:root / /usr Happy to run any diagnostics if that's useful.