SSH error: "must be owned by root and not group or world-writable"

This topic explains why the "must be owned by root and not group or world-writable" error occurs when you start the SSH service on a Linux ECS instance and how to resolve it.

Symptoms

The SSH service fails to start on a Linux ECS instance. The system logs contain error entries similar to the following:

May 17 17:31:57 ecs-centos72-test systemd: Failed to start OpenSSH server daemon.
May 17 17:31:57 ecs-centos72-test systemd: Unit sshd.service entered failed state.
May 17 17:31:57 ecs-centos72-test systemd: sshd.service failed.
May 17 17:32:39 ecs-centos72-test systemd: sshd.service holdoff time over, scheduling restart.
May 17 17:32:39 ecs-centos72-test systemd: Starting OpenSSH server daemon...
May 17 17:32:39 ecs-centos72-test sshd: /var/empty/sshd must be owned by root and not group or world-writable.
May 17 17:32:39 ecs-centos72-test systemd: sshd.service: main process exited, code=exited, status=255/n/a
May 17 17:32:39 ecs-centos72-test systemd: Failed to start OpenSSH server daemon.
May 17 17:32:39 ecs-centos72-test systemd: Unit sshd.service entered failed state.
May 17 17:32:39 ecs-centos72-test systemd: sshd.service failed.

Cause

For security, the SSH service requires its related directories and files to have specific permissions and ownership. This error occurs if the/var/empty/sshd directory is owned by a different user or group.

Solution

To resolve this issue, correct the owner and group of the/var/empty/sshd directory.

Connect to the ECS instance by using a VNC remote connection.

For more information, see Connection methods overview.
Run the following command to check the permissions of the/var/empty/sshd directory.
```
ll /var/empty/
```
The following output indicates that the/var/empty/sshd directory is owned by the linux user and belongs to the linux group. You must change the owner and group to root.
```
[xxx@xxx xxx]# ll /var/empty/
total 4
drwx--x--x. 2 linux linux 4096 Oct 20  2017 sshd
```
Run the following commands to restore the default configuration.

Important
The chmod command in this example is specific to CentOS 7. The required permissions for the /var/empty/sshd directory may vary depending on the Linux distribution. To find the correct permissions, check the configuration of another instance running the same Linux distribution.
```
chown -R root:root /var/empty/sshd
chmod -R 711 /var/empty/sshd
```
Run the following command to restart the SSH service.
```
systemctl restart sshd.service
```