The SSH server is invoked by simply typing its name:

    $ sshd

The server automatically runs in the background, so no ampersand is required at the end of the line.

To invoke the server when the host computer boots, add appropriate lines to an appropriate startup file on your system, such as /etc/rc.local on Linux. For example:

    # Specify the path to sshd.
    SSHD=/usr/local/sbin/sshd
    # If sshd exists and is executable, run it and echo success to the system console.
    if [ -x "$SSHD" ]
    then
      $SSHD && echo 'Starting sshd'
    fi

Both OpenSSH and Tectia come with a startup or boot script (i.e., a System-V-style init control script) found in the appropriate directory for each Unix variant. For Linux, for example, the scripts are /etc/init.d/sshd for OpenSSH and /etc/init.d/sshd2 for Tectia.^[44]

Any user can run sshd if several steps are completed beforehand:

Before starting, ask your system administrator if you may run an SSH server. While this isn’t necessary from a technical standpoint, it is a wise idea. An administrator might not appreciate your creating a new avenue for logins behind his back. Likewise, if the administrator has disabled SSH or certain SSH features, there’s probably a good security reason and you shouldn’t just work around it!

Next, generate your own host key. Any other existing host key is probably readable only by the superuser. Host keys are generated with the program ssh-keygen. [6.2] For now, to create a 1024-bit DSA host key and store it in the file ~/myserver/hostkey, type the following for OpenSSH:

    # OpenSSH: Note the -N value is two single quotes, not a double-quote
    $ ssh-keygen -N '' -b 1024 -t dsa -f ~/myserver/hostkey

This command generates the files hostkey and hostkey.pub in the directory ~/myserver (so make sure the directory exists). Here’s the analogous command for Tectia:

    # Tectia
    $ ssh-keygen -P -b 1024 -t dsa ~/myserver/hostkey

The -N (OpenSSH) and -P (Tectia) options cause the generated key to be left unencrypted because sshd expects to read it without a passphrase.

Third, select a port number on which the SSH server listens for connections. The port number is set with the -p command-line option of sshd or the Port keyword in the configuration file, as we discuss later. Your server can’t listen on port 22, the default, because only the superuser may run processes to listen on that port. Your port number must be greater than or equal to 1024, as lower port numbers are reserved by the operating system for use by privileged programs. [3.4.3.6] The port number also must not conflict with those in use by other programs on the server computer; if it does, you get an error message when you try to start the server:

    error: bind: Address already in use

If you receive this error, try another integer in the free range (above 1024). Avoid numbers mentioned in the computer’s services map (usually /etc/services or the Network Information Service [NIS] “services” map, which you can view with the Unix command ypcat -k services). These numbers have been designated by the system administrator for use with particular programs or protocols, so you might cause trouble if you steal one. The command netstat -a lists all ports in use; add the -n option to see numeric values for the ports instead of service names.

Finally, create your own SSH server configuration file. Otherwise, your server will use built-in defaults or a systemwide configuration file (if one exists) and might not operate as you intend.

Assuming you have generated a host key in ~/myserver/hostkey, selected the port number 2345, and created a configuration file in ~/myserver/config, the server is invoked with the command:

    $ sshd -h ~/myserver/hostkey -p 2345 -f ~/myserver/config

A server run by an ordinary user has some disadvantages:

Nevertheless, for many users, the advantages of SSH outweigh these inconveniences. Assuming your system administrator approves, you can secure your logins with sshd even if you aren’t a superuser.