I installed OpenSSH on my Windows 7 system so I could tunnel my VNC into it from my Arch machine. However, when I run /usr/sbin/sshd -D on the W7 machine, I get the error: /var/empty must be owned by root and not group or world-writable.

This is the output of the ls -All /var:

$ ls -All /var
total 0
drwxr-xr-x+ 1 {my_usrnm} None           0 Jul 15 21:39 cache
drw-------+ 1 cyg_server Administrators 0 Jul 15 21:43 empty
drwxr-xr-x+ 1 {my_usrnm} None           0 Jul 15 21:39 lib
drwxrwxrwt+ 1 {my_usrnm} None           0 Jul 15 21:45 log
drwxrwxrwt+ 1 {my_usrnm} None           0 Jul 15 23:36 run
drwxrwxrwt+ 1 {my_usrnm} None           0 Jul 15 21:39 tmp

I've tried a few of the permissions fixes and rebooted and reinstalled OpenSSH (by running ssh-host-config) at least 10 times, but nothing had fixed it.

How do I fix this error? Thanks!

  • Did you install sshd through the cygwin installer? – Julie Pelletier Jul 16 '16 at 6:47
  • yes @JuliePelletier – ZuluDeltaNiner Jul 16 '16 at 6:49
  • 1
    it says owned by cyg_server shouldn't it say root ? try chown root /var/empty – Jasen Jul 16 '16 at 6:51
  • other sites I looked at (including this: stackoverflow.com/a/20473488/1184062), show the owner as cyg_server @JuliePelletier – ZuluDeltaNiner Jul 16 '16 at 6:53
  • It depends on the user the service runs as, and you need to run the cygwin shell as an administrator. If you're already running it as an administrator, I guess your service could be running as the SYSTEM user. – Julie Pelletier Jul 16 '16 at 6:55

The directory owner and permission are correct. During configuration use the PrivilegeSeparation option.

Start the demon as service

cygrunsrv -S sshd

Example of directory permission on a functional system

$ icacls $(cygpath -w /var/empty)
E:\cygwin64\var\empty NULL SID:(DENY)(Rc,S,REA,X,DC)
                      NT AUTHORITY\SYSTEM:(RX)
                      CREATOR OWNER:(OI)(CI)(IO)(F)
                      CREATOR GROUP:(OI)(CI)(IO)(RX)

Successfully processed 1 files; Failed processing 0 files

They are reported in the cygwin way as

$ getfacl /var/empty
# file: /var/empty
# owner: cyg_server
# group: Administrators

If there are spurious extra ACL permission the usage of setfacl -b /var/empty/ could be useful.

  • I still get the /var/empty message in sshd.log. I can ssh into that computer from that computer (i.e. localhost), but I can't from my arch machine (it times out). – ZuluDeltaNiner Jul 16 '16 at 16:20
  • My permissions were not correct, so I ran $ setfacl -s "u::rwx,g::r-x,o::r-x" /var/empty, which gave me this output for getfacl (pastebin). However, I still get the /var/empty error. – ZuluDeltaNiner Jul 17 '16 at 16:19
  • what is the output of icacls $(cygpath -w /var/empty) ? – matzeri Jul 17 '16 at 17:04
  • pastebin – ZuluDeltaNiner Jul 17 '16 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.