$ /usr/sbin/sshd -f testconfig -p 22025 -d

debug1: sshd version OpenSSH_5.2p1
debug1: private host key: #0 type 0 RSA1
debug1: read PEM private key done: type RSA
debug1: private host key: #1 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #2 type 2 DSA
debug1: setgroups() failed: Operation not permitted
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-f'
debug1: rexec_argv[2]='testconfig'
debug1: rexec_argv[3]='-p'
debug1: rexec_argv[4]='22025'
debug1: rexec_argv[5]='-d'
debug1: Bind to port 22025 on
Server listening on port 22025.
Generating 1024 bit RSA key.
RSA key generation complete.
debug1: fd 4 clearing O_NONBLOCK
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 4 out 4 newsock 4 pipe -1 sock 7
debug1: inetd sockets after dupping: 3, 3
Connection from port 58477
debug1: Client protocol version 2.0; client software version OpenSSH_5.5
debug1: match: OpenSSH_5.5 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.2
debug1: privsep_preauth: successfully loaded Seatbelt profile for unprivileged child
debug1: list_hostkey_types: 
No supported key exchange algorithms
debug1: do_cleanup
debug1: do_cleanup
debug1: audit_event: unhandled event 12


$ ssh dgl@ -p 22025 -i ./id_rsa.pub -v
OpenSSH_5.5p1, OpenSSL 0.9.8o 01 Jun 2010
debug1: Reading configuration data /Users/dgl/.ssh/config
debug1: Reading configuration data /opt/local/etc/ssh/ssh_config
debug1: Connecting to [] port 22025.
debug1: Connection established.
debug1: identity file ./id_rsa.pub type 1
debug1: identity file ./id_rsa.pub-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.2
debug1: match: OpenSSH_5.2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.5
debug1: SSH2_MSG_KEXINIT sent
Connection closed by


Protocol 1,2
HostKey ./ssh_host_key
HostKey ./ssh_host_rsa_key
HostKey ./ssh_host_dsa_key
RSAAuthentication yes
PubkeyAuthentication yes
  • 2
    does this error happen with a plain-vanilla sshd_config?
    – warren
    Jul 7, 2010 at 13:17
  • What is the contant of testconfig? Hostkey and such do not belong into ssh_config.
    – ott--
    Oct 11, 2011 at 17:48
  • I forgot to use sudo when starting it with -d, gave me the same error... Apr 13, 2017 at 19:43

10 Answers 10


I just hit the same issue, solved it by turning my relative HostKey path into an absolute one, i.e. instead of

HostKey ./ssh_host_key


HostKey /home/dmitry/ssh_host_key

or wherever it is.

That error isn't very helpful is it?


I ran into this problem on Fedora. Eventually I noticed:

root@wisdom:/etc/ssh# ll
total 268K
drwxr-xr-x.   2 root root     4.0K Jun 30 06:06 ./
drwxr-xr-x. 128 root root      12K Jun 30 05:15 ../
-rw-r--r--.   1 root root     237K Jun  8 23:30 moduli
-rw-r--r--.   1 root root     2.2K Jun  8 23:30 ssh_config
-rw-------.   1 root root     4.3K Jun 30 06:03 sshd_config
-rw-r-----.   1 root ssh_keys    0 Jun 27 00:46 ssh_host_ecdsa_key
-rw-r--r--.   1 root root        0 Jun 27 00:46 ssh_host_ecdsa_key.pub
-rw-r-----.   1 root ssh_keys    0 Jun 27 00:46 ssh_host_ed25519_key
-rw-r--r--.   1 root root        0 Jun 27 00:46 ssh_host_ed25519_key.pub
-rw-r-----.   1 root ssh_keys    0 Jun 27 00:46 ssh_host_rsa_key
-rw-r--r--.   1 root root        0 Jun 27 00:46 ssh_host_rsa_key.pub

The key files are zero length! I generated new key pairs and it fixed the problem:

ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key
ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key
  • Thanks, this worked for me. I experienced the same on a CentOS 7.1 minimal installation.
    – Torsten
    Aug 7, 2015 at 17:34
  • Got exactly the same thing on a minimal Fedora 22 installation. Thanks for the hint.
    – Lefteris
    Jan 19, 2016 at 22:08
  • Perhaps it goes without saying, but you'll get this if the keys are invalid in any way (e.g. you have a public key in a private key filename) Mar 29, 2018 at 15:10
  • worked for me as well on a fresh Ubuntu server 18.04.1 Sep 19, 2018 at 21:17
  • This helped on newly installed raspberry pi zero with rasbian-stretch-lite image. Thanks!
    – J-ho
    Jan 18, 2019 at 16:42

FWIW, I just ran into the same error message, but with a different cause. In my case the problem turned out to be that my host private key files were mode 640 instead of 600. A quick chmod and sshd restart solved the problem. I guess the common theme here is sshd not loading the host keys for one reason or another.


I've just had this issue hacking around with cloud-init. In my case, the cause was that the host keys had not been generated, and dpkg-reconfigure openssh-server (Debian/Ubuntu -specific) fixed it.

  • I was getting the same issue with host keys being stripped by virt-sysprep - Since my guests are debian based I added the command line option --firstboot-command "dpkg-reconfigure openssh-server"
    – marsbard
    Nov 18, 2016 at 15:50

I actually ran into this problem...and it was our good old friend SELinux.

Running setenforce 0 proves that it worked but this isn't a good solution. However, as soon as that helped to make the ultimate solution more clear.

$ cd /etc/ssh
$ restorecon -Rv *

Re-enabling SELinux (setenforce 1) ... and all is well.


I ran into this error message and solved it by setting:

UsePAM yes

It only happened with passwordless accounts (like root).


To me what fixed was to add this lines do /etc/ssh/sshd_config:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192

KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exch

HostkeyAlgorithms +ssh-dss

In my case, the issue was an over-enthusiastic apparmor profile.

I was also receiving the following message in my /var/log/auth.log file:

fatal: linux_audit_write_entry failed: Permission denied

Resolved by running:

aa-complain /etc/apparmor.d/usr.sbin.sshd

In my scenario it was wrong permissions for private keys:

Permissions 0444 for '/etc/ssh/ssh_host_rsa_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
key_load_private: bad permissions
Could not load host key: /etc/ssh/ssh_host_rsa_key
  • This answer has already been given 8 years ago. Jun 5, 2019 at 13:58

I wasted 6 hours on this! I tried all of the solutions here plus so many more! to no avail! then purged openssh-server and reinstalled it and it worked great and I reconfigured everything which took about 15 minutes! And I learned a great lesson!

Never waste your time on debugging something that you can get back to work be resetting it!

There is no gain in dealing with every bit of every config file and debug info of every application!

  • But what if resetting didn't solve your issue? Perhaps you could've tried to reset at the beginning, or tried setting this up on another new box.
    – oxr463
    Jun 5, 2019 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.