FreeBSD 12 – Common Problem 004 – sshd Fails to Start Because of Host Key Permissions

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Remote login is unavailable, causing immediate operational lockout risk.

Environment & Reproduction

Occurs after manual file copy, restore, or permission drift in `/etc/ssh`.

Root Cause Analysis

`sshd` rejects insecure host key permissions or incorrect ownership.

Quick Triage

Check service and recent auth logs.

service sshd status
tail -n 50 /var/log/auth.log
ls -l /etc/ssh/ssh_host_*

Step-by-Step Diagnosis

Validate key mode and configuration syntax before restart.

sshd -t
stat -f '%N %Su:%Sg %Sp' /etc/ssh/ssh_host_*
service sshd onestatus

Solution – Primary Fix

Apply strict ownership and permissions, then restart service.

chown root:wheel /etc/ssh/ssh_host_*
chmod 600 /etc/ssh/ssh_host_*_key
service sshd restart

Solution – Alternative Approaches

Regenerate missing keys with `ssh-keygen -A` if corruption is detected.

Verification & Acceptance Criteria

`service sshd status` is running and new SSH sessions succeed.

Rollback Plan

Restore prior keyset from secure backup and restart `sshd`.

Prevention & Hardening

Enforce file permission policy checks and monitor `auth.log` startup warnings.

Related Errors & Cross-Refs

`bad ownership or modes for file`, `sshd: no hostkeys available — exiting`.

Related tutorial: View the step-by-step tutorial for freebsd-12.

View all freebsd-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

`sshd_config(5)`, `sshd(8)`, OpenSSH hardening guide.