5

I am running a Centos machine in Amazon cloud. Suddenly, I can't ssh into it. Fortunately, there is R Studio running that includes an ability to run BASH shell. So, I see in /var/log/boot.log that sshd failed to start.

When I run it from the command line sudo service sshd start I get an error that Starting sshd: /etc/ssh/sshd_config: Permission denied. I tried to set sshd_config permissions to either 644 or 600 - but I get the same error. Also I tried sudo su - and then start service.

And it is not the limitation of the shell itself: I can start httpd without any problems.

I don't even know what else to try...

5
  • what is the perms on /etc/ssh ls -ld /etc/ssh? Is it executable?
    – Petter H
    Aug 24, 2013 at 7:15
  • yes, 755 drwxr-xr-x. 2 root root 4096 Aug 24 02:05 /etc/ssh
    – Felix
    Aug 24, 2013 at 8:11
  • @Felix sshd_config should be chmoded to 600 or u+rw,o=. Make sure you check it using ls -l sshd_config Also make sure that the problem is coming from sshd_config and not other misconfigured source. Aug 24, 2013 at 9:28
  • verify that sshd did not lose its sticky bit, too Aug 24, 2013 at 18:54
  • @sendmoreinfo - could you elaborate on it... I don't think sshd ever had sticky bit in the first place - why would you expect it to have it? Or maybe I misunderstand what you are saying
    – Felix
    Aug 25, 2013 at 21:20

2 Answers 2

8

I was faced with the same issue, and thanks to Felix answer, I could confirm that it was also an SELINUX error :

# grep "sshd_config" /var/log/audit/audit.log
...
type=AVC msg=audit(1585907328.579:143): avc:  denied  { read } for  pid=1207 comm="sshd" name="sshd_config" dev="dm-0" ino=443439 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file
...

I was then able to solve the error by restoring the default contexts:

# restorecon /etc/ssh/sshd_config

That way SELINUX didn't need to be disabled.

3

This is what happened... There was a problem with the image (specifics here: https://bugzilla.redhat.com/show_bug.cgi?id=956531). So, as part of troubleshooting I mounted the EBS drive on a different machine, and "cleaned" sshd_config. That caused SELINUX to deny access to this file, and the error message was caused by SELINUX; not by file permissions. Once I disabled SELINUX, sshd came up fine.

World is saved :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .