Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm aiming to start up a second sshd instance on a non-privileged port (e.g. 2222) with my own configuration file.

Obviously, the sshd process can't setuid so logging in as users other than the one who is running the sshd daemon is clearly impossible.

However, is it possible to have a working sshd daemon that will work for the currently running user? For my use case, this would be fine.

I tried booting up an sshd instance with my own config file and host key and the sshd process starts up (no complaints about not being root, like some commands), however when I try to connect to that port, the sshd process dies.

$ /usr/sbin/sshd -dD -h .ssh/id_rsa -p 2222 
debug1: sshd version OpenSSH_5.6p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: setgroups() failed: Operation not permitted
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-dD'
debug1: rexec_argv[2]='-h'
debug1: rexec_argv[3]='.ssh/id_rsa'
debug1: rexec_argv[4]='-p'
debug1: rexec_argv[5]='2222'
debug1: Bind to port 2222 on
Server listening on port 2222.
debug1: Bind to port 2222 on ::.
Server listening on :: port 2222.
debug1: fd 6 clearing O_NONBLOCK
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 6 out 6 newsock 6 pipe -1 sock 9
debug1: inetd sockets after dupping: 5, 5
Connection from ::1 port 57670
debug1: Client protocol version 2.0; client software version OpenSSH_5.6
debug1: match: OpenSSH_5.6 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.6
debug1: list_hostkey_types: 
No supported key exchange algorithms
debug1: do_cleanup
debug1: do_cleanup
debug1: audit_event: unhandled event 12

The debug1: setgroups() failed: Operation not permitted line obviously sticks out, but it doesn't die until it tries to accept a connection.

share|improve this question
up vote 18 down vote accepted

After a bit of digging around I figured it out.

Start the process with sshd -f ~/.ssh/sshd_config where /.ssh/sshd_config is a new file you created. Among other options (such as a different host key, different port, etc) you need to add the line UsePrivilegeSeparation no. This will prevent the sshd process from trying to do any setuid or setgid calls and allow it to continue running as your user and accept connections as your user.

EDIT: A few moments after figuring it out somebody else tweeted this link to me which confirms this is the correct way to do this:

share|improve this answer
Good job. Don't forget to accept your own answer. =) – Wesley Dec 28 '11 at 2:54
:) I'm not allowed to yet, but I will soon. – Bo Jeanes Dec 29 '11 at 3:23
You also need to disable PAM by setting UsePam to no. – haridsv Apr 19 '15 at 17:11
@bjeanes does it work for you? can you share your sshd_config file? it complain "Set" is not a valid command for me when i try on ubuntu. – jojo Mar 29 at 0:15
@jojo I don't run this configuration so I have no file to share. You're going to have to start with a known working file and adjust to your needs. – Bo Jeanes Apr 7 at 1:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.