38

I'm aiming to start up a second sshd instance on a non-privileged port (e.g. 2222) with my own configuration file.

Obviously, the sshd process can't setuid so logging in as users other than the one who is running the sshd daemon is clearly impossible.

However, is it possible to have a working sshd daemon that will work for the currently running user? For my use case, this would be fine.

I tried booting up an sshd instance with my own config file and host key and the sshd process starts up (no complaints about not being root, like some commands), however when I try to connect to that port, the sshd process dies.

$ /usr/sbin/sshd -dD -h .ssh/id_rsa -p 2222 
debug1: sshd version OpenSSH_5.6p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: setgroups() failed: Operation not permitted
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-dD'
debug1: rexec_argv[2]='-h'
debug1: rexec_argv[3]='.ssh/id_rsa'
debug1: rexec_argv[4]='-p'
debug1: rexec_argv[5]='2222'
debug1: Bind to port 2222 on 0.0.0.0.
Server listening on 0.0.0.0 port 2222.
debug1: Bind to port 2222 on ::.
Server listening on :: port 2222.
debug1: fd 6 clearing O_NONBLOCK
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 6 out 6 newsock 6 pipe -1 sock 9
debug1: inetd sockets after dupping: 5, 5
Connection from ::1 port 57670
debug1: Client protocol version 2.0; client software version OpenSSH_5.6
debug1: match: OpenSSH_5.6 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.6
debug1: list_hostkey_types: 
No supported key exchange algorithms
debug1: do_cleanup
debug1: do_cleanup
debug1: audit_event: unhandled event 12

The debug1: setgroups() failed: Operation not permitted line obviously sticks out, but it doesn't die until it tries to accept a connection.

34

After a bit of digging around I figured it out.

Start the process with sshd -f ~/.ssh/sshd_config where /.ssh/sshd_config is a new file you created. Among other options (such as a different host key, different port, etc) you need to add the line UsePrivilegeSeparation no. This will prevent the sshd process from trying to do any setuid or setgid calls and allow it to continue running as your user and accept connections as your user.

EDIT: A few moments after figuring it out somebody else tweeted this link to me which confirms this is the correct way to do this: http://cygwin.com/ml/cygwin/2008-04/msg00363.html

  • 1
    You also need to disable PAM by setting UsePam to no. – haridsv Apr 19 '15 at 17:11
  • @bjeanes does it work for you? can you share your sshd_config file? it complain "Set" is not a valid command for me when i try on ubuntu. – jojo Mar 29 '16 at 0:15
  • @jojo I don't run this configuration so I have no file to share. You're going to have to start with a known working file and adjust to your needs. – Bo Jeanes Apr 7 '16 at 1:25
  • 1
    The disabling PAM thing is only for specific cases. Works for me on Fedora without messing with the pam setting. See the linked email message in the answer for some more ideas what else needs to be changed to get all things nice. I'll update soon my notes how I made it work for docker: hub.docker.com/r/aosqe/ssh-git-server (please allow a couple of days before reading it) – akostadinov May 26 '16 at 14:29
5

As an update to this thread, OpenSSH in version 7.5 deprecated the UsePrivilegeSeparation option, making it impossible to disable privilege separation. It appears that running SSHD as a user is now impossible.

See https://www.openssh.com/releasenotes.html

  • Depending on the server configuration, this may not be the case. I have no problem running sshd as a normal user while indicating "UsePrivilegeSeparation yes" or "UsePrivilegeSeparation sandbox" in my sshd config file. – a3nm Aug 26 '18 at 14:24
2

I have checked in detail the possibility of running sshd service as a normal user. Detail of the version of the program:

sshd version OpenSSH_7.4, OpenSSL 1.0.2k

Finally after solving many errors, I reached to a point that SSHD aborted with the following error:

Attempt to write login records by non-root user (aborting)

I checked the source code to see whether it is possible to solve the issue without changing the source code. See the code here. Some part of the code causing abortion of the program:

#ifndef HAVE_CYGWIN
    if (geteuid() != 0) {
        logit("Attempt to write login records by non-root user (aborting)");
        return (1);
    }
#endif

It checks the user privilege by (geteuid() != 0) and here causes the problem.

1

Assuming what @magiclantern noted above and assuming you don't want to patch sshd will something like Dropbear work for you? It is used in many embedded devices that want an ssh server with smaller footprint (and fewer features/configs).

  • 1
    dropbear -E -F -R -w -g -a -p 2222 -P ./dbearPID # does the trick – dotbit Jul 18 at 12:38
1

Here is a userland bash sript based on the Bo Jeanes answer that :

  • Create working dir in home
  • generate server keys in the working dir
  • generate basic config file with pid file located in the working dir
  • launch SSH daemon

mkdir ${HOME}/custom_ssh
ssh-keygen -f ${HOME}/custom_ssh/ssh_host_rsa_key -N '' -t rsa
ssh-keygen -f ${HOME}/custom_ssh/ssh_host_dsa_key -N '' -t dsa
echo "Port 2222
HostKey ${HOME}/custom_ssh/ssh_host_rsa_key
HostKey ${HOME}/custom_ssh/ssh_host_dsa_key
AuthorizedKeysFile  .ssh/authorized_keys
ChallengeResponseAuthentication no
UsePAM yes
Subsystem   sftp    /usr/lib/ssh/sftp-server
PidFile ${HOME}/custom_ssh/sshd.pid" > ${HOME}/custom_ssh/sshd_config
/usr/bin/sshd -f ${HOME}/custom_ssh/sshd_config
echo "
--------
Process ID : ${HOME}/custom_ssh/sshd.pid
-------"
  • OpenSSH_7.9p1, OpenSSL 1.1.1a 20 Nov 2018
  • pam auth (tested with same local & remote user)
  • I still see: "debug1: setgroups() failed: Operation not permitted" – dotbit Jul 18 at 12:25
  • Good solution, but you should make commands look better. Ugly. – MAChitgarha Jul 24 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.