53

I'm aiming to start up a second sshd instance on a non-privileged port (e.g. 2222) with my own configuration file.

Obviously, the sshd process can't setuid so logging in as users other than the one who is running the sshd daemon is clearly impossible.

However, is it possible to have a working sshd daemon that will work for the currently running user? For my use case, this would be fine.

I tried booting up an sshd instance with my own config file and host key and the sshd process starts up (no complaints about not being root, like some commands), however when I try to connect to that port, the sshd process dies.

$ /usr/sbin/sshd -dD -h .ssh/id_rsa -p 2222 
debug1: sshd version OpenSSH_5.6p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: setgroups() failed: Operation not permitted
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-dD'
debug1: rexec_argv[2]='-h'
debug1: rexec_argv[3]='.ssh/id_rsa'
debug1: rexec_argv[4]='-p'
debug1: rexec_argv[5]='2222'
debug1: Bind to port 2222 on 0.0.0.0.
Server listening on 0.0.0.0 port 2222.
debug1: Bind to port 2222 on ::.
Server listening on :: port 2222.
debug1: fd 6 clearing O_NONBLOCK
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 6 out 6 newsock 6 pipe -1 sock 9
debug1: inetd sockets after dupping: 5, 5
Connection from ::1 port 57670
debug1: Client protocol version 2.0; client software version OpenSSH_5.6
debug1: match: OpenSSH_5.6 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.6
debug1: list_hostkey_types: 
No supported key exchange algorithms
debug1: do_cleanup
debug1: do_cleanup
debug1: audit_event: unhandled event 12

The debug1: setgroups() failed: Operation not permitted line obviously sticks out, but it doesn't die until it tries to accept a connection.

6 Answers 6

51

Start the process with sshd -f ~/.ssh/sshd_config where ~/.ssh/sshd_config is a new file you created. Among other options (such as a different host key, different port, etc) you need to add the line UsePrivilegeSeparation no. This will prevent the sshd process from trying to do any setuid or setgid calls and allow it to continue running as your user and accept connections as your user.

(This link confirms it is the correct way: http://cygwin.com/ml/cygwin/2008-04/msg00363.html )

5
  • 1
    You also need to disable PAM by setting UsePam to no.
    – haridsv
    Apr 19, 2015 at 17:11
  • 1
    @bjeanes does it work for you? can you share your sshd_config file? it complain "Set" is not a valid command for me when i try on ubuntu.
    – jojo
    Mar 29, 2016 at 0:15
  • @jojo I don't run this configuration so I have no file to share. You're going to have to start with a known working file and adjust to your needs.
    – Bo Jeanes
    Apr 7, 2016 at 1:25
  • 1
    The disabling PAM thing is only for specific cases. Works for me on Fedora without messing with the pam setting. See the linked email message in the answer for some more ideas what else needs to be changed to get all things nice. I'll update soon my notes how I made it work for docker: hub.docker.com/r/aosqe/ssh-git-server (please allow a couple of days before reading it) May 26, 2016 at 14:29
  • Deprecated option UsePrivilegeSeparation
    – Et7f3XIV
    Jan 11 at 2:04
15

Here is a userland bash script based on the Bo Jeanes' answer that :

  • Creates a working dir in home
  • Generates server keys in the working dir
  • Generates a basic config file with pid file located in the working dir
  • launches an SSH daemon
mkdir ${HOME}/custom_ssh
ssh-keygen -f ${HOME}/custom_ssh/ssh_host_rsa_key -N '' -t rsa
ssh-keygen -f ${HOME}/custom_ssh/ssh_host_dsa_key -N '' -t dsa

cat << EOF > ${HOME}/custom_ssh/sshd_config
Port 2222
HostKey ${HOME}/custom_ssh/ssh_host_rsa_key
HostKey ${HOME}/custom_ssh/ssh_host_dsa_key
AuthorizedKeysFile  .ssh/authorized_keys
ChallengeResponseAuthentication no
UsePAM yes
Subsystem   sftp    /usr/lib/ssh/sftp-server
PidFile ${HOME}/custom_ssh/sshd.pid
EOF

/usr/bin/sshd -f ${HOME}/custom_ssh/sshd_config
echo "----- Process ID : ${HOME}/custom_ssh/sshd.pid -------"
  • OpenSSH_7.9p1, OpenSSL 1.1.1a 20 Nov 2018
  • pam auth (tested with same local & remote user)
6
  • 2
    I still see: "debug1: setgroups() failed: Operation not permitted"
    – dotbit
    Jul 18, 2019 at 12:25
  • Good solution, but you should make commands look better. Ugly. Jul 24, 2019 at 14:50
  • Yes, just changing the PidFile path was sufficient for me... Duh!...
    – migle
    Jan 28, 2020 at 14:39
  • 1
    I had to set UsePAM to no in Ubuntu as it was having an issue with access message of the day
    – Luke
    Mar 24, 2023 at 7:04
  • 1
    From man sshd_config: If UsePAM is enabled, you will not be able to run sshd(8) as a non-root user. The default is no. For Debian openssh-server package, the default for UsePAM is yes
    – Good Pen
    Nov 25, 2023 at 11:03
14

As an update to this thread, OpenSSH in version 7.5 deprecated the UsePrivilegeSeparation option, making it impossible to disable privilege separation. It appears that running SSHD as a user is now impossible.

See https://www.openssh.com/releasenotes.html

3
  • 1
    Depending on the server configuration, this may not be the case. I have no problem running sshd as a normal user while indicating "UsePrivilegeSeparation yes" or "UsePrivilegeSeparation sandbox" in my sshd config file.
    – a3nm
    Aug 26, 2018 at 14:24
  • 3
    Well I haven't tried it yet, but I think this is "fixed" now: "sshd(8): when started without root privileges, don't require the privilege separation user or path to exist. Makes running the regression tests easier without touching the filesystem." Nov 12, 2019 at 7:12
  • OpenSSH 7.5 was released on 2017-03-20.
    – domih
    Jan 22, 2021 at 9:56
4

Assuming what @magiclantern noted above and assuming you don't want to patch sshd will something like Dropbear work for you? It is used in many embedded devices that want an ssh server with smaller footprint (and fewer features/configs).

2
  • 4
    dropbear -E -F -R -w -g -a -p 2222 -P ./dbearPID # does the trick
    – dotbit
    Jul 18, 2019 at 12:38
  • dropbearkey -t rsa -f ./dropbear_rsa_host_key and then dropbear -E -F -w -g -a -p 2222 -P ./dbearPID -r ./dropbear_rsa_host_key
    – Dagelf
    Jun 15, 2022 at 10:26
3

I have checked in detail the possibility of running sshd service as a normal user. Detail of the version of the program:

sshd version OpenSSH_7.4, OpenSSL 1.0.2k

Finally after solving many errors, I reached to a point that SSHD aborted with the following error:

Attempt to write login records by non-root user (aborting)

I checked the source code to see whether it is possible to solve the issue without changing the source code. See the code here. Some part of the code causing abortion of the program:

#ifndef HAVE_CYGWIN
    if (geteuid() != 0) {
        logit("Attempt to write login records by non-root user (aborting)");
        return (1);
    }
#endif

It checks the user privilege by (geteuid() != 0) and here causes the problem.

3
  • I ran into this error as well, but it happens only with debug output activated. Without debug output there's no error, I can run sshd in user-mode just fine.
    – CharlesB
    Sep 28, 2021 at 21:56
  • Hi @CharlesB, I'm having trouble* setting up a rootless sshd server on alpine docker container. Would you be kind enough to share contents of your sshd_config file? *trouble = even though providing correct password, it always keeps rejecting with Permission denied, please try again..
    – Lukas
    Nov 22, 2022 at 8:07
  • @Lukas Sorry this was long ago I don't have this setup anymore
    – CharlesB
    Nov 23, 2022 at 10:20
0

For ubuntu users, the answer above (https://serverfault.com/a/946877/994202) should be :

mkdir ${HOME}/custom_ssh
ssh-keygen -f ${HOME}/custom_ssh/ssh_host_rsa_key -N '' -t rsa
ssh-keygen -f ${HOME}/custom_ssh/ssh_host_dsa_key -N '' -t dsa


cat << EOF > ${HOME}/custom_ssh/sshd_config
Port 6666
HostKey ${HOME}/custom_ssh/ssh_host_rsa_key
HostKey ${HOME}/custom_ssh/ssh_host_dsa_key
PidFile ${HOME}/custom_ssh/sshd.pid
EOF

/usr/sbin/sshd -f ${HOME}/custom_ssh/sshd_config 

Then type ssh -p 6666 your_not_root_user_name@your_ip in local shell.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .