I mean:

if the sshd is't being run in root account, then how can it let the remote ssh client run shell or other command in root account ?

if sshd call the login command, then the user could login as the root. becuase the user supplied the root passowrd, and the UNIX knows it.

BUT sshd also has a passowrd-less function. That is it stores the public key of the ssh client. In this situation, the ssh client don't type in a password for the login command. how the UNIX system let the ssh client run shell as ROOT user ? if the sshd is not a root account.


My question is sshd can be used to login server without a password.

so, need it to be run in root privilege ?

If not, how does the server allow the client to run in root account ?

  • Do you want to know how to make sshd server ask for a password when trying to login? – tachomi Jan 20 '16 at 20:06
  • If user supply a password then, sshd just use this password to open a shell, redirect the io to remote. how can the sshd server do this without a password and root privilege? – lovespring Jan 20 '16 at 20:14
  • This question would benefit from proofreading by someone with a better command of English. I don't understand what you mean either. – András Korn Jan 20 '16 at 20:33
  • 2
    No. If you run sshd without root privileges and use public key authentication, than you can log in only as the user running the sshd. For other users you need the password to get the shell if I am right. – Jakuje Jan 22 '16 at 11:26

It was asked before on ServerFault. Quoting with few modification and notes:

Start the process with /usr/sbin/sshd -f ~/.ssh/sshd_config where ~/.ssh/sshd_config is a new file you created. Among other options (such as a different host key, different port, etc) you need to add the line UsePrivilegeSeparation no. This will prevent the sshd process from trying to do any setuid or setgid calls and allow it to continue running as your user and accept connections as your user.

Also don't forget to use unprivileged port (>1024).

| improve this answer | |

I believe you need is ssh-keygen, which remembers your "device signature". So even you changed your password, it still works as long as you ssh from the same device.

Here is a detailed tutorial how to set it up.

Does it need to be run in root privilege?

  • No, you only need root privilege on the host-server when you set it up, in order to edit some file under the home directory of root. Once it is set up, you can do it without entering the root password anymore.
| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.