5.2. Running the ServerOrdinarily, an SSH server is invoked when the host computer is booted, and it is left running as a daemon. This works fine for most purposes. Alternatively, you can invoke the server manually. This is advantageous when you're debugging a server, experimenting with server options, or running a server as a nonsuperuser. Manual invocation requires a bit more work and forethought but might be the only alternative for some situations. Most commonly, a computer has just one SSH server running on it. It handles multiple connections by spawning child processes, one per connection. You can run multiple servers if you like, however. For example, you might run both sshd1 and sshd2, or several versions of a server, each listening on a different TCP port.
Or sshd can be invoked by inetd, creating one sshd process per connection. [Section 220.127.116.11, "Invocation by inetd"]
5.2.1. Running as the SuperuserThe SSH server is invoked by simply typing its name:
The server automatically runs in the background, so no ampersand is required at the end of the line. To invoke the server when the host computer boots, add appropriate lines to /etc/rc.local or the appropriate startup file on your system. For example:# SSH1, SSH2, OpenSSH $ sshd
SSH2 comes with a sample SysV-style init control script, named sshd2.startup.# Specify the path to sshd. SSHD=/usr/local/bin/sshd # If sshd exists, run it and echo success to the system console. if [ -x "$SSHD" ] then $SSHD && echo 'Starting sshd' fi
5.2.2. Running as an Ordinary UserAny user can run sshd, provided that several steps are completed beforehand:
This command generates the files hostkey and hostkey.pub in the directory ~/myserver (so make sure the directory exists). Here's the analogous command for SSH2:# SSH1, OpenSSH $ ssh-keygen -N '' -b 1024 -f ~/myserver/hostkey
The -P and -N cause the generated key to be saved in plaintext, because sshd expects to read it without prompting someone for a passphrase. Third, you must select a port number on which the SSH server listens for connections. The port number is set with the -p command-line option of sshd or the Port keyword in the configuration file, as we discuss later. Your server can't listen on port 22, the default, because only the superuser may run processes to listen on that port. Your port number must be greater than or equal to 1024, as lower port numbers are reserved by the operating system for use by privileged programs. [Section 18.104.22.168, "Trusted-host authentication (Rhosts and RhostsRSA)"] The port number also must not conflict with those in use by other programs on the server computer; if it does, you get an error message when you try to start the server:# SSH2 only $ ssh-keygen2 -P -b 1024 ~/myserver/hostkey
If you receive this error, try another integer in the free range (above 1024). Avoid numbers mentioned in the computer's services map (usually /etc/services or the Network Information Service (NIS) "services" map, which you can view with the Unix command ypcat -k services). These numbers have been designated by the system administrator for use with particular programs or protocols, so you might be causing trouble if you steal one. Finally, you must create your own SSH server configuration file. Otherwise, the server uses built-in defaults or a systemwide configuration file (if one exists) and might not operate as you intend. Assuming you have generated a host key in ~/myserver/hostkey, selected the port number 2345, and created a configuration file in ~/myserver/config, the server is invoked with the command:error: bind: Address already in use
A server run by an ordinary user has some disadvantages:# SSH1, SSH2, OpenSSH $ sshd -h ~/myserver/hostkey -p 2345 -f ~/myserver/config
Copyright © 2002 O'Reilly & Associates. All rights reserved.