I installed OpenSSH on my Windows 7 system so I could tunnel my VNC into it from my Arch machine. However, when I run /usr/sbin/sshd -D on the W7 machine, I get the error: /var/empty must be owned by root and not group or world-writable.

This is the output of the ls -All /var:

$ ls -All /var
total 0
drwxr-xr-x+ 1 {my_usrnm} None           0 Jul 15 21:39 cache
drw-------+ 1 cyg_server Administrators 0 Jul 15 21:43 empty
drwxr-xr-x+ 1 {my_usrnm} None           0 Jul 15 21:39 lib
drwxrwxrwt+ 1 {my_usrnm} None           0 Jul 15 21:45 log
drwxrwxrwt+ 1 {my_usrnm} None           0 Jul 15 23:36 run
drwxrwxrwt+ 1 {my_usrnm} None           0 Jul 15 21:39 tmp

I've tried a few of the permissions fixes and rebooted and reinstalled OpenSSH (by running ssh-host-config) at least 10 times, but nothing had fixed it.

How do I fix this error? Thanks!

  • Did you install sshd through the cygwin installer? Jul 16, 2016 at 6:47
  • yes @JuliePelletier Jul 16, 2016 at 6:49
  • 2
    it says owned by cyg_server shouldn't it say root ? try chown root /var/empty
    – Jasen
    Jul 16, 2016 at 6:51
  • other sites I looked at (including this: stackoverflow.com/a/20473488/1184062), show the owner as cyg_server @JuliePelletier Jul 16, 2016 at 6:53
  • It depends on the user the service runs as, and you need to run the cygwin shell as an administrator. If you're already running it as an administrator, I guess your service could be running as the SYSTEM user. Jul 16, 2016 at 6:55

1 Answer 1


The directory owner and permission are correct. During configuration use the PrivilegeSeparation option.

Start the demon as service

cygrunsrv -S sshd

Example of directory permission on a functional system

$ icacls $(cygpath -w /var/empty)
E:\cygwin64\var\empty NULL SID:(DENY)(Rc,S,REA,X,DC)
                      NT AUTHORITY\SYSTEM:(RX)
                      CREATOR OWNER:(OI)(CI)(IO)(F)
                      CREATOR GROUP:(OI)(CI)(IO)(RX)

Successfully processed 1 files; Failed processing 0 files

They are reported in the cygwin way as

$ getfacl /var/empty
# file: /var/empty
# owner: cyg_server
# group: Administrators

If there are spurious extra ACL permission the usage of setfacl -b /var/empty/ could be useful.

  • I still get the /var/empty message in sshd.log. I can ssh into that computer from that computer (i.e. localhost), but I can't from my arch machine (it times out). Jul 16, 2016 at 16:20
  • My permissions were not correct, so I ran $ setfacl -s "u::rwx,g::r-x,o::r-x" /var/empty, which gave me this output for getfacl (pastebin). However, I still get the /var/empty error. Jul 17, 2016 at 16:19
  • what is the output of icacls $(cygpath -w /var/empty) ?
    – matzeri
    Jul 17, 2016 at 17:04
  • pastebin Jul 17, 2016 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.