Search code examples
linuxsshopensshsshd

SSH server started with a system account not accepting connections

I started a new SSH daemon with a config file with a non-standard port number. Now if I start the SSHD as sudo I can SSH onto the host but if i start as a different system account, the daemon starts but the connections fail. Does the SSHD always need to be started as root ?

I made sure the SSHD is running, it just doesnt accept connections.

Solution

  • It is not practical to run sshd as non-root. sshd needs root privileges for

    • password authentication (only root can access /etc/shadow)
    • binding to a port that is below 1024
    • calling setuid() in order to obtain the privileges of the user that has connected

    If you use an unprivileged port and key-based only auth, you may be able to make it work, but you'll be restricted to connections with the user that is running sshd.

    There is a relevant discussion here: http://seclists.org/basics/2003/Aug/564