docker compose ssh service not running

Thanks for this wonderful tool.

While trying to migrate my borg repos to this solution with the docker-compose method, I got the following error:

Remote: kex_exchange_identification: read: Connection reset by peer
Remote: Connection reset by 192.168.1.109 port <portnumber>
Connection closed by remote host. Is borg working on the server?

So I tried to docker exec to a terminal in the container to see what was happening, and service ssh status got the following message:

sshd is not running ... failed!

So I tried to start it with service ssh start and I get:

mkdir: cannot create directory '/run/sshd': Permission denied

Which is quite explicit. However I checked anyway:

borgwarehouse@fb1c5b11de60:~/app$ ls /run
adduser  dbus  lock  log  runit  sendsigs.omit.d  shm  systemd  user

Is there something missing to my setup?

my sshd.log file is full of:

...
2024-12-10T01:54:01.874089+00:00 sshd Bind to port 22 on 0.0.0.0 failed: Permission denied.
2024-12-10T01:54:01.874144+00:00 sshd Bind to port 22 on :: failed: Permission denied.
2024-12-10T01:54:01.874155+00:00 sshd Cannot bind any address.
2024-12-10T01:54:04.154504+00:00 sshd Bind to port 22 on 0.0.0.0 failed: Permission denied.
2024-12-10T01:54:04.154574+00:00 sshd Bind to port 22 on :: failed: Permission denied.
2024-12-10T01:54:04.154585+00:00 sshd Cannot bind any address.
2024-12-10T01:54:07.230951+00:00 sshd Bind to port 22 on 0.0.0.0 failed: Permission denied.
2024-12-10T01:54:07.231003+00:00 sshd Bind to port 22 on :: failed: Permission denied.
2024-12-10T01:54:07.231021+00:00 sshd Cannot bind any address.

Hi, sorry for taking so long to reply. It's really seems to be a permission issue. On your volume, or on your user that run container. Can you check this ?

I am also running into this issue - after first startup of borgwarehouse I encounter this
2024-12-29T19:57:32.434896+00:00 sshd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 2024-12-29T19:57:32.434911+00:00 sshd @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ 2024-12-29T19:57:32.434914+00:00 sshd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 2024-12-29T19:57:32.434916+00:00 sshd Permissions 0755 for '/etc/ssh/ssh_host_rsa_key' are too open. 2024-12-29T19:57:32.434919+00:00 sshd It is required that your private key files are NOT accessible by others. 2024-12-29T19:57:32.434921+00:00 sshd This private key will be ignored. 2024-12-29T19:57:32.435000+00:00 sshd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 2024-12-29T19:57:32.435008+00:00 sshd @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ 2024-12-29T19:57:32.435010+00:00 sshd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 2024-12-29T19:57:32.435012+00:00 sshd Permissions 0755 for '/etc/ssh/ssh_host_ecdsa_key' are too open. 2024-12-29T19:57:32.435014+00:00 sshd It is required that your private key files are NOT accessible by others. 2024-12-29T19:57:32.435016+00:00 sshd This private key will be ignored. 2024-12-29T19:57:32.435052+00:00 sshd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 2024-12-29T19:57:32.435056+00:00 sshd @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ 2024-12-29T19:57:32.435059+00:00 sshd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 2024-12-29T19:57:32.435061+00:00 sshd Permissions 0755 for '/etc/ssh/ssh_host_ed25519_key' are too open. 2024-12-29T19:57:32.435064+00:00 sshd It is required that your private key files are NOT accessible by others. 2024-12-29T19:57:32.435066+00:00 sshd This private key will be ignored. 2024-12-29T19:57:32.435263+00:00 sshd sshd: no hostkeys available -- exiting. 2024-12-29T19:57:35.463774+00:00 sshd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 2024-12-29T19:57:35.463794+00:00 sshd @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ 2024-12-29T19:57:35.463798+00:00 sshd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 2024-12-29T19:57:35.463800+00:00 sshd Permissions 0755 for '/etc/ssh/ssh_host_rsa_key' are too open. 2024-12-29T19:57:35.463803+00:00 sshd It is required that your private key files are NOT accessible by others. 2024-12-29T19:57:35.463804+00:00 sshd This private key will be ignored. 2024-12-29T19:57:35.463860+00:00 sshd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 2024-12-29T19:57:35.463867+00:00 sshd @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ 2024-12-29T19:57:35.463873+00:00 sshd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 2024-12-29T19:57:35.463892+00:00 sshd Permissions 0755 for '/etc/ssh/ssh_host_ecdsa_key' are too open. 2024-12-29T19:57:35.463895+00:00 sshd It is required that your private key files are NOT accessible by others. 2024-12-29T19:57:35.463902+00:00 sshd This private key will be ignored. 2024-12-29T19:57:35.463941+00:00 sshd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 2024-12-29T19:57:35.463945+00:00 sshd @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ 2024-12-29T19:57:35.463948+00:00 sshd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 2024-12-29T19:57:35.463951+00:00 sshd Permissions 0755 for '/etc/ssh/ssh_host_ed25519_key' are too open. 2024-12-29T19:57:35.463955+00:00 sshd It is required that your private key files are NOT accessible by others. 2024-12-29T19:57:35.463963+00:00 sshd This private key will be ignored. 2024-12-29T19:57:35.464153+00:00 sshd sshd: no hostkeys available -- exiting.

After chmodding the keys to 600 and restart - I get this:

==> logs/sshd.log <== 2024-12-29T19:58:08.920993+00:00 sshd Bind to port 22 on 0.0.0.0 failed: Permission denied. 2024-12-29T19:58:08.921011+00:00 sshd Bind to port 22 on :: failed: Permission denied. 2024-12-29T19:58:08.921015+00:00 sshd Cannot bind any address. 2024-12-29T19:58:10.948308+00:00 sshd Bind to port 22 on 0.0.0.0 failed: Permission denied. 2024-12-29T19:58:10.948322+00:00 sshd Bind to port 22 on :: failed: Permission denied. 2024-12-29T19:58:10.948324+00:00 sshd Cannot bind any address. 2024-12-29T19:58:13.977293+00:00 sshd Bind to port 22 on 0.0.0.0 failed: Permission denied. 2024-12-29T19:58:13.977308+00:00 sshd Bind to port 22 on :: failed: Permission denied. 2024-12-29T19:58:13.977310+00:00 sshd Cannot bind any address.

I try to run borgwarehouse on my Synology as a Docker Container with the image from docker hub using the default uid/guid (1001:1001) which maps to a user and group "backup".

when I try to start sshd in the running docker container with the default user (1001:1001) I get this:

borgwarehouse@30b605c308c4:~/app$ /etc/init.d/ssh start
mkdir: cannot create directory '/run/sshd': Permission denied

and when I connect to the container with user = root sshd starts up as expected:

root@30b605c308c4:/home/borgwarehouse/app# /etc/init.d/ssh start
Starting OpenBSD Secure Shell server: sshd.

... it seem to me that sshd is not designed to be run as non-root user.
See here and here for details and hints

feat: use dropbear instead of ssh (Ravinou#370)

until #401 is resolved, is there a workaround for this? I seem to be experiencing the same issue

until #401 is resolved, is there a workaround for this? I seem to be experiencing the same issue

Configuring Open-SSH to use a non-root Port (e.g. 22222) is currently working for me.

I haven't had time to address this issue and reproduce yet. But the port 22 hypothesis seems excellent to me. I've never used the default port and that's perhaps why I've never found myself in this case. If this is indeed the problem, I need to add it clearly to the docker documentation.

@epicfacethe3rd

@RagingCub and @epicfacethe3rd , did you try to use a non-root port or did you solved your issue differently ?

@Ravinou

@Ravinou Maybe my problem when actually installing borgwarehouse for the first time is related to this issue.

Ubuntu 22.04 LTS
using docker installation
making minimum adaptions to .env
added
UNIX_USER=myuser (which is 1001:1001)
edited (as I did not change my reverse proxy configuration yet and just wanted to test in LAN)

Hostname and URL

FQDN=192.168.178.96
NEXTAUTH_URL=http://192.168.178.96

Login with default credentials only re-shows the login dialog.

Curl test with

curl --request POST --url 'http://localhost:3000/api/cronjob/getStorageUsed' --header 'Authorization: Bearer xxx'

Reply is {"status":401,"message":"Unauthorized"}

I did nothing to configure sshd ...

Additional information:

I want to have access to the borgwarehouse GUI from internet, access to my web servers is realized via nginx reverse proxy. What is the recommended configuration for this use case?

I have now tried to do this several times but it just doesn't work.

I have changed the port via sshd_config and also in the Docker variable the

    ports:
      - “${WEB_SERVER_PORT:?WEB_SERVER_PORT variable missing}:3000”
      - “22222:22222”

userID und Gruppen ID are by default (1001)
adjusted so that it works but I get no connection.
Somehow I am too stupid to use Borgwarehouse :-( I would like to have a control center but somehow it doesn't work

you need to make sure that you have the .env file setup correctly.

# Host port mappings
WEB_SERVER_PORT=3000
SSH_SERVER_PORT=22222

And in the docker-compose.yml you need this:

env_file:
      - .env

and this:

ports:
      - "${SSH_SERVER_PORT:?SSH_SERVER_PORT variable missing}:22222"

The extra line under ports 22222:22222 should be removed as it is already covered by the .env file and the line

- "${SSH_SERVER_PORT:?SSH_SERVER_PORT variable missing}:22222"

in the docker-compose.yml

This should not make any difference whether I enter the port directly or via the variable ?
but i will test it again

If you have already set the environment variable correctly (with port 22222) in the .env file, then it is correct that it makes no difference except that the reference between the environment variable and the assignment of the ports in the docker-compose.yml is not so easily recognizable.

If you have not yet customized the .env file, then it should make a significant difference. Without customization, borgwarehouse probably starts the ssh daemon on port 22 by default. The port setting in the docker-compose.yml is only an assignment and 22222:22222 would point to nothing, since the local port 22222 is not activated, but port 22.

Ok, what if I leave out the port in the docker compose, since I want to run this via a reverse proxy would this work?

means the .env looks like this

# Host port mappings
WEB_SERVER_PORT=3000
SSH_SERVER_PORT=222222

# Hostname and URL
FQDN=your.domain.com
NEXTAUTH_URL=https://your.domain.com

# Secrects
NEXTAUTH_SECRET=your-secret
CRONJOB_KEY=your-other-secret

# UID:GID must match the user and group ID of the host folders and must be > 1000
# If you want to use a different user than 1001:1001, you must rebuild the image yourself.
UID=1001
GID=1001

and compose like this

services:
  borgwarehouse:
    container_name: borgwarehouse
    image: borgwarehouse/borgwarehouse
    user: "${UID:?UID variable missing}:${GID:?GID variable missing}"
    env_file:
      - .env
    volumes:
      - ${CONFIG_PATH:?CONFIG_PATH variable missing}:/home/borgwarehouse/app/config
      - ${SSH_PATH:?SSH_PATH variable missing}:/home/borgwarehouse/.ssh
      - ${SSH_HOST:?SSH_HOST variable missing}:/etc/ssh
      - ${BORG_REPOSITORY_PATH:?BORG_REPOSITORY_PATH variable missing}:/home/borgwarehouse/repos
      - ${TMP_PATH:?TMP_PATH variable missing}:/home/borgwarehouse/tmp
      - ${LOGS_PATH:?LOGS_PATH variable missing}:/home/borgwarehouse/logs
    networks:
      - proxy
networks:
  proxy:
   external: true

Unfortunately it does not work =( I have no idea why
it creates the sshd_config according to the default port 22 if i then change it to 22222 it still does not work after a restart

"Connection closed by remote host. Is borg working on the server?"

seams that the ssh server doesn't want to changed to 22222

... maybe because of this typo: SSH_SERVER_PORT=222222 (6x2 instead of 5x2) ?

... have you verified, that sshd started at all/properly - I normally do this inside of the docker container with docker exec -ti borgwarehous bash and there checking with something like telnet localhost 22222 and telnet localhost 3000

Maybe switching the log level of sshd to DEBUG in combination with something like journalctl -xef might help identifying the problem.

i have tried again unfortunately borghouse is not interested and tries to start sshd on 22 which does not work

i tried it again unfortunately borghouse is not interested and keeps trying to start sshd on 22 which does not work

or I am just too stupid

The authenticity of host '[xxx.xxx.xxx.xxx.xxx]:22222 ([xxx.xxx.xxx.xxx.xxx]:22222)' cannot be determined.
The fingerprint of the key ED25519 is *****.
This key is not known under any other name.
Are you sure you want to continue the connection (yes/no/[fingerprint])? yes
Removed: Warning: Permanently added '[1xxx.xxx.xxx.xxx]:22222' (ED25519) to the list of known hosts.
Removed: borgwarehouse@xxx.xxx.xxx.xxx: Permission denied (publickey).
Connection from remote host closed. Does borg work on the server?

maybe it only runs because I am too stupid but with SSH public key

Hi, I am trying to use this wonderful tool, on a Synology216+II (will be important)... and I also stumbled upon these issues, so to summarize:

The UID/GID issue was my first problem, on Synology I cannot create a user with a specific ID, nor a group. So I ended up using my userID and created a backup group, which got the 65k ID, so I use this combination for now.
The host keys generated had permission 777 on my side... this is a relatively easy fix in your sh script, to make sure this is not the case... please also adjust other files too in the sshd folder with a chmod (I see you already use this command elsewhere in the init script)
Port 22 cannot be used, but you have it fixed in your sshd_config template... I would suggest to have it as an env parameter and sed it in the file after copying, so therefore it could be generated properly4. I still had an issue, and this is a weird one: the SSHD service started, but connections were reset immediately in the key exchange part. I had one error in the sshd.log file

Fatal glibc error: cannot get entropy for arc4random

This is due to the problem of modern sshd and its use of a specific kernel-feature, that is simply not present in my Synology Kernel... Synology kernel cannot be updated, so I have tried to fallback to an earlier version of the base image (ChatGPT suggested this): Debian Bullseye. Make sure in this process that you also switch the repositories and the version to be installed from bookwork-backports to bullseye-backports. Maybe... maybe. Could you build alternative images? You seem to have only one, but it seems it would be nice to have some older Debian versions too. Or maybe an instruction how to use the host machine's sshd? I am not sure if this is doable.

feat: use dropbear instead of ssh (Ravinou#370)

Navigation Menu

Repository navigation

docker compose ssh service not running #370

Hostname and URL

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

docker compose ssh service not running #370

Description

Activity

LoupLabelle commented on Dec 10, 2024

Ravinou commented on Dec 26, 2024

cschlaefcke commented on Dec 29, 2024

cschlaefcke commented on Dec 29, 2024

cschlaefcke commented on Dec 29, 2024

cschlaefcke commented on Dec 29, 2024

cschlaefcke commented on Dec 29, 2024

epicfacethe3rd commented on Feb 20, 2025

cschlaefcke commented on Feb 20, 2025

Ravinou commented on Feb 20, 2025

Ravinou commented on Mar 19, 2025

SprickW commented on Apr 19, 2025

Hostname and URL

lastsamurai26 commented on Apr 28, 2025

cschlaefcke commented on Apr 28, 2025

lastsamurai26 commented on Apr 28, 2025

cschlaefcke commented on Apr 28, 2025

lastsamurai26 commented on Apr 29, 2025

cschlaefcke commented on Apr 29, 2025

cschlaefcke commented on Apr 29, 2025

lastsamurai26 commented on Apr 29, 2025

zkutasi commented on Jun 11, 2025

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions