I just switched my Guix System-based server over to unprivileged guix-
daemon, after which I was unable to ssh into it. From the client, the
syndrome looks like this (shell variables indicate redactions):
$ ssh $my_server
kex_exchange_identification: read: Connection reset by peer
Connection reset by $ip_address port 22
or with -v:
$ ssh -v $my_server
OpenSSH_9.9p2, OpenSSL 3.3.3 11 Feb 2025
debug1: Reading configuration data $HOME/.ssh/config
debug1: $HOME/.ssh/config line 31: Applying options for tinka
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to $my_server [$ip_address] port 22.
debug1: Connection established.
debug1: identity file $HOME/.ssh/$private_key type 0
[more lines about identity files omitted...]
debug1: Local version string SSH-2.0-OpenSSH_9.9
kex_exchange_identification: read: Connection reset by peer
Connection reset by $ip_address port 22
Fortunately, I can get into the server using a serial console,
and the problem is quite clear from server-side logs:
2025-04-25 20:27:40 localhost shepherd[1]: Accepted connection on 0.0.0.0:22
from $client_ip:51626.
2025-04-25 20:27:40 localhost shepherd[1]: Starting service sshd-69...
2025-04-25 20:27:40 localhost shepherd[1]: Service sshd-69 has been started.
2025-04-25 20:27:40 localhost shepherd[1]: Service sshd-69 started.
2025-04-25 20:27:40 localhost shepherd[1]: Service sshd-69 running with value
#<<process> id: 234 command:
("/gnu/store/8kman284vvlzk2hgy1bv1xzys3rfdzlr-openssh-10.0p1/sbin/sshd" "-D"
"-f" "/gnu/store/vwy5d5mj35rh147iwzkzxijld0gx06mb-sshd_config" "-i")>.
2025-04-25 20:27:40 localhost sshd[234]: fatal:
/gnu/store/8kman284vvlzk2hgy1bv1xzys3rfdzlr-openssh-10.0p1/var/empty must be
owned by root and not group or world-writable.
2025-04-25 20:27:40 localhost shepherd[1]: 0 connections still in use after
sshd-69 termination.
2025-04-25 20:27:40 localhost shepherd[1]: Service sshd-69 (PID 234) exited
with 255.
2025-04-25 20:27:40 localhost shepherd[1]: Service sshd-69 has been disabled.
2025-04-25 20:27:40 localhost shepherd[1]: Transient service sshd-69
terminated, now unregistered.
# ls -l /gnu/store/8kman284vvlzk2hgy1bv1xzys3rfdzlr-openssh-10.0p1
total 24
dr-xr-xr-x 2 guix-daemon guix-daemon 4096 Jan 1 1970 bin/
dr-xr-xr-x 2 guix-daemon guix-daemon 4096 Jan 1 1970 etc/
dr-xr-xr-x 2 guix-daemon guix-daemon 4096 Jan 1 1970 libexec/
dr-xr-xr-x 2 guix-daemon guix-daemon 4096 Jan 1 1970 sbin/
dr-xr-xr-x 4 guix-daemon guix-daemon 4096 Jan 1 1970 share/
dr-xr-xr-x 3 guix-daemon guix-daemon 4096 Jan 1 1970 var/
# ls -l /gnu/store/8kman284vvlzk2hgy1bv1xzys3rfdzlr-openssh-10.0p1/var
total 4
dr-xr-xr-x 2 guix-daemon guix-daemon 4096 Jan 1 1970 empty/
`chown root:root
/gnu/store/8kman284vvlzk2hgy1bv1xzys3rfdzlr-openssh-10.0p1/var/empty`
is sufficient to fix ssh, but I wonder if store contents in general should
maybe remain
owned by root regardless of whether the daemon is running as an unprivileged
user.
It seems likely to me that this will not be the only such problem.
zw
