I installed OpenSSH on my Windows 7 system so I could tunnel my VNC into it from my Arch machine. However, when I run /usr/sbin/sshd -D on the W7 machine, I get the error: /var/empty must be owned by root and not group or world-writable.

This is the output of the ls -All /var:

$ ls -All /var
total 0
drwxr-xr-x+ 1 {my_usrnm} None           0 Jul 15 21:39 cache
drw-------+ 1 cyg_server Administrators 0 Jul 15 21:43 empty
drwxr-xr-x+ 1 {my_usrnm} None           0 Jul 15 21:39 lib
drwxrwxrwt+ 1 {my_usrnm} None           0 Jul 15 21:45 log
drwxrwxrwt+ 1 {my_usrnm} None           0 Jul 15 23:36 run
drwxrwxrwt+ 1 {my_usrnm} None           0 Jul 15 21:39 tmp

I've tried a few of the permissions fixes and rebooted and reinstalled OpenSSH (by running ssh-host-config) at least 10 times, but nothing had fixed it.

How do I fix this error? Thanks!

  • Did you install sshd through the cygwin installer? Jul 16, 2016 at 6:47
  • yes @JuliePelletier Jul 16, 2016 at 6:49
  • 2
    it says owned by cyg_server shouldn't it say root ? try chown root /var/empty
    – Jasen
    Jul 16, 2016 at 6:51
  • other sites I looked at (including this: stackoverflow.com/a/20473488/1184062), show the owner as cyg_server @JuliePelletier Jul 16, 2016 at 6:53
  • It depends on the user the service runs as, and you need to run the cygwin shell as an administrator. If you're already running it as an administrator, I guess your service could be running as the SYSTEM user. Jul 16, 2016 at 6:55

1 Answer 1


The directory owner and permission are correct. During configuration use the PrivilegeSeparation option.

Start the demon as service

cygrunsrv -S sshd

Example of directory permission on a functional system

$ icacls $(cygpath -w /var/empty)
E:\cygwin64\var\empty NULL SID:(DENY)(Rc,S,REA,X,DC)
                      NT AUTHORITY\SYSTEM:(RX)
                      CREATOR OWNER:(OI)(CI)(IO)(F)
                      CREATOR GROUP:(OI)(CI)(IO)(RX)

Successfully processed 1 files; Failed processing 0 files

They are reported in the cygwin way as

$ getfacl /var/empty
# file: /var/empty
# owner: cyg_server
# group: Administrators

If there are spurious extra ACL permission the usage of setfacl -b /var/empty/ could be useful.

  • I still get the /var/empty message in sshd.log. I can ssh into that computer from that computer (i.e. localhost), but I can't from my arch machine (it times out). Jul 16, 2016 at 16:20
  • My permissions were not correct, so I ran $ setfacl -s "u::rwx,g::r-x,o::r-x" /var/empty, which gave me this output for getfacl (pastebin). However, I still get the /var/empty error. Jul 17, 2016 at 16:19
  • what is the output of icacls $(cygpath -w /var/empty) ?
    – matzeri
    Jul 17, 2016 at 17:04
  • pastebin Jul 17, 2016 at 17:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .