Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm aiming to start up a second sshd instance on a non-privileged port (e.g. 2222) with my own configuration file.

Obviously, the sshd process can't setuid so logging in as users other than the one who is running the sshd daemon is clearly impossible.

However, is it possible to have a working sshd daemon that will work for the currently running user? For my use case, this would be fine.

I tried booting up an sshd instance with my own config file and host key and the sshd process starts up (no complaints about not being root, like some commands), however when I try to connect to that port, the sshd process dies.

$ /usr/sbin/sshd -dD -h .ssh/id_rsa -p 2222 
debug1: sshd version OpenSSH_5.6p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: setgroups() failed: Operation not permitted
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-dD'
debug1: rexec_argv[2]='-h'
debug1: rexec_argv[3]='.ssh/id_rsa'
debug1: rexec_argv[4]='-p'
debug1: rexec_argv[5]='2222'
debug1: Bind to port 2222 on 0.0.0.0.
Server listening on 0.0.0.0 port 2222.
debug1: Bind to port 2222 on ::.
Server listening on :: port 2222.
debug1: fd 6 clearing O_NONBLOCK
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 6 out 6 newsock 6 pipe -1 sock 9
debug1: inetd sockets after dupping: 5, 5
Connection from ::1 port 57670
debug1: Client protocol version 2.0; client software version OpenSSH_5.6
debug1: match: OpenSSH_5.6 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.6
debug1: list_hostkey_types: 
No supported key exchange algorithms
debug1: do_cleanup
debug1: do_cleanup
debug1: audit_event: unhandled event 12

The debug1: setgroups() failed: Operation not permitted line obviously sticks out, but it doesn't die until it tries to accept a connection.

share|improve this question

1 Answer 1

up vote 6 down vote accepted

After a bit of digging around I figured it out.

Start the process with sshd -f ~/.ssh/sshd_config where /.ssh/sshd_config is a new file you created. Among other options (such as a different host key, different port, etc) you need to add the line UsePrivilegeSeparation no. This will prevent the sshd process from trying to do any setuid or setgid calls and allow it to continue running as your user and accept connections as your user.

EDIT: A few moments after figuring it out somebody else tweeted this link to me which confirms this is the correct way to do this: http://cygwin.com/ml/cygwin/2008-04/msg00363.html

share|improve this answer
    
Good job. Don't forget to accept your own answer. =) –  Wesley Dec 28 '11 at 2:54
    
:) I'm not allowed to yet, but I will soon. –  bjeanes Dec 29 '11 at 3:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.