# OpenSSH Recovery and Dropbear Migration

A practical guide for restoring OpenSSH on antiX 23 and switching from Dropbear to
OpenSSH as the primary SSH server.

This note covers a particular situation where `openssh-server` is installed but
the SSH service cannot start because the system user required for privilege
separation is missing.

It also covers disabling Dropbear when OpenSSH is intended to be the only SSH
server.

---

## 1. Check the Installed SSH Servers

First, check whether Dropbear and/or OpenSSH are installed:

```bash
dpkg -l | grep -E "dropbear|openssh"
```

Then check which process is currently listening on TCP port 22:

```bash
ss -tlnp | grep :22
```

If Dropbear is running, it may already occupy the SSH port.

---

## 2. Check Dropbear

Check the Dropbear service:

```bash
sudo service dropbear status
```

If necessary, check for a running process:

```bash
ps aux | grep dropbear
```

If the goal is to use OpenSSH exclusively, Dropbear should eventually be
stopped and disabled.

---

## 3. Check the OpenSSH Configuration

Before attempting to start OpenSSH, test its configuration:

```bash
sudo sshd -t
```

If the system reports:

```text
Privilege separation user sshd does not exist
```

the required `sshd` system user is missing.

Check for it directly:

```bash
id sshd
```

If the result is:

```text
id: 'sshd': no such user
```

create the system account.

---

## 4. Create the `sshd` System User

Create a system user without a home directory:

```bash
sudo adduser \
  --system \
  --group \
  --no-create-home \
  --home /run/sshd \
  --shell /usr/sbin/nologin \
  sshd
```

The account is used by OpenSSH for privilege separation. It is not intended
for interactive login.

---

## 5. Create `/run/sshd`

Make sure the runtime directory exists:

```bash
sudo mkdir -p /run/sshd
sudo chmod 755 /run/sshd
```

---

## 6. Test OpenSSH Again

Run the configuration test once more:

```bash
sudo sshd -t
```

A successful test normally produces no output.

If an error is reported, resolve that problem before starting the service.

---

## 7. Start OpenSSH

Start the service:

```bash
sudo service ssh start
```

If it is already running:

```bash
sudo service ssh restart
```

Check its status:

```bash
sudo service ssh status
```

---

## 8. Verify the Listening Port

Check whether OpenSSH is listening on TCP port 22:

```bash
ss -tlnp | grep :22
```

The output should show an `sshd` process listening on the configured SSH port.

---

# Switching from Dropbear to OpenSSH

If OpenSSH is working correctly and is intended to be the primary SSH server,
Dropbear can be stopped and disabled.

## Stop Dropbear

```bash
sudo service dropbear stop
```

## Disable Dropbear at Boot

```bash
sudo update-rc.d dropbear disable
```

The Dropbear package does not have to be removed immediately. Keeping it
installed can be useful until OpenSSH has been tested successfully.

---

## Enable OpenSSH at Boot

Enable the OpenSSH service:

```bash
sudo update-rc.d ssh defaults
```

Then start or restart it:

```bash
sudo service ssh restart
```

---

## Final Verification

Check the OpenSSH configuration:

```bash
sudo sshd -t
```

Check the service:

```bash
sudo service ssh status
```

Check the listening port:

```bash
ss -tlnp | grep :22
```

An optional local connection test:

```bash
ssh localhost
```

---

# Expected Result

After completing the procedure:

* OpenSSH is installed and functioning.
* The required `sshd` system account exists.
* OpenSSH listens on the configured SSH port.
* Dropbear is stopped.
* Dropbear does not start automatically.
* OpenSSH starts automatically during system boot.
* The Dropbear package may remain installed until it is no longer needed.

---

## Quick Recovery Sequence

When the specific `sshd` privilege-separation error occurs, the essential
sequence is:

```bash
id sshd
sudo sshd -t

sudo adduser \
  --system \
  --group \
  --no-create-home \
  --home /run/sshd \
  --shell /usr/sbin/nologin \
  sshd

sudo mkdir -p /run/sshd
sudo chmod 755 /run/sshd

sudo sshd -t
sudo service ssh restart

ss -tlnp | grep :22
```

If switching completely from Dropbear to OpenSSH:

```bash
sudo service dropbear stop
sudo update-rc.d dropbear disable
sudo update-rc.d ssh defaults
sudo service ssh restart
```

---

## Note

This procedure documents a specific antiX 23 setup in which `openssh-server`
was installed but the expected `sshd` system user was missing.

The exact service state and package behaviour can vary between antiX/Debian
releases. Always verify the actual error with `sshd -t` before creating accounts
or changing services.