Debian 12 – sshd fails to start because host key permissions are insecure

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

SSH daemon refuses to start, causing remote administration outage.

Environment & Reproduction

Common after manual key copy/restore with wrong owner or mode bits.

Root Cause Analysis

OpenSSH hard-fails when host key files are writable/readable by unauthorized users.

Quick Triage

Inspect sshd logs and file metadata under /etc/ssh/ for key files.

Step-by-Step Diagnosis

Confirm permissions and syntax before restarting daemon.
– shell: `sudo sshd -t && ls -l /etc/ssh/ssh_host_*`
– python: `python3 -c “import subprocess; print(subprocess.getoutput(‘journalctl -u ssh -b –no-pager | tail -n 50’))”`
– perl: `perl -e ‘print q{Check ownership should be root:root}’`

Solution – Primary Fix

Restore secure ownership/modes and restart ssh service.
– shell: `sudo chown root:root /etc/ssh/ssh_host_* && sudo chmod 600 /etc/ssh/ssh_host_* && sudo systemctl restart ssh`
– python: `python3 -c “import subprocess; print(subprocess.getoutput(‘systemctl status ssh –no-pager’))”`
– perl: `perl -e ‘print q{Regenerate keys only if files are corrupt or missing}’`

Solution – Alternative Approaches

Regenerate host keys with ssh-keygen when compromised, then rotate trust fingerprints.

Verification & Acceptance Criteria

sshd starts cleanly, `sshd -t` passes, and remote login succeeds.

Rollback Plan

Restore original host keys from secure backup if fingerprint rotation is not acceptable.

Prevention & Hardening

Enforce file permission baselines with CIS checks and configuration management.

Related Errors & Cross-Refs

Related to bad ownership or modes for directory /etc/ssh and key load failures.

Related tutorial: View the step-by-step tutorial for debian-12.

View all debian-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

OpenSSH sshd_config, sshd(8), and Debian security hardening documentation.