Arch Linux

kennyisalive

Member

Registered: 2026-01-26

Posts: 29

Re: [Solved] SSH client works only by sudo

Try to mask that

systemctl --user mask gpg-agent-ssh.socket

and see whether you still run into it.

didn't work

The question is why ssh triggers the socket, ie likely runs but omits the result of "gpgconf --list-dirs agent-ssh-socket"

 /run/user/1000/gnupg/S.gpg-agent.ssh 

seth

Member

From: Don't DM me only for attention

Registered: 2012-09-03

Posts: 73,387

Re: [Solved] SSH client works only by sudo

didn't work

Don't do that, https://bbs.archlinux.org/viewtopic.php?id=57855

What did not work? Masking the service? What's currently running?

/run/user/1000/gnupg/S.gpg-agent.ssh

You were not supposed to run that, I was speculating what might happen.

Create a fresh user, boot the multi-user.target (2nd linkbelow) and log in as the new user.
Do you still run into the askpass error?
Do you when logging in from the multi-user.target as you regular user?

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

kennyisalive

Member

Registered: 2026-01-26

Posts: 29

Re: [Solved] SSH client works only by sudo

What did not work? Masking the service? What's currently running?

Still "ssh_askpass: exec(/usr/lib/ssh/ssh-askpass): No such file or directory"  when i try connect to remote host and added message: "Host key verification failed." Complete output:

 debug1: OpenSSH_10.2p1, OpenSSL 3.6.1 27 Jan 2026
debug1: Reading configuration data /home/mt/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Reading configuration data /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf
debug1: Connecting to s-docs-dev [192.168.200.30] port 22.
debug1: Connection established.
debug1: loaded pubkey from /home/mt/.ssh/id_rsa: RSA SHA256:2JXPkzuBjDNWMMBVguoXtKUWFJAwGVo+7z+bIx2Hudo
debug1: identity file /home/mt/.ssh/id_rsa type 0
debug1: no identity pubkey loaded from /home/mt/.ssh/id_rsa
debug1: no pubkey loaded from /home/mt/.ssh/id_ecdsa
debug1: identity file /home/mt/.ssh/id_ecdsa type -1
debug1: no identity pubkey loaded from /home/mt/.ssh/id_ecdsa
debug1: no pubkey loaded from /home/mt/.ssh/id_ecdsa_sk
debug1: identity file /home/mt/.ssh/id_ecdsa_sk type -1
debug1: no identity pubkey loaded from /home/mt/.ssh/id_ecdsa_sk
debug1: loaded pubkey from /home/mt/.ssh/id_ed25519: ED25519 SHA256:66YTkyqLF4Zc2BBnOA1+RA1FsctHYsIY9BshRsOAwcA
debug1: identity file /home/mt/.ssh/id_ed25519 type 2
debug1: no identity pubkey loaded from /home/mt/.ssh/id_ed25519
debug1: no pubkey loaded from /home/mt/.ssh/id_ed25519_sk
debug1: identity file /home/mt/.ssh/id_ed25519_sk type -1
debug1: no identity pubkey loaded from /home/mt/.ssh/id_ed25519_sk
debug1: Local version string SSH-2.0-OpenSSH_10.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.6p1 Ubuntu-3ubuntu13.14
debug1: compat_banner: match: OpenSSH_9.6p1 Ubuntu-3ubuntu13.14 pat OpenSSH* compat 0x04000000
debug1: Authenticating to host:22 as 'user'
debug1: load_hostkeys: fopen /home/mt/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: sntrup761x25519-sha512@openssh.com
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:et5yu7O6e/dmB/oXnpuJJKQWUcmdR5KDxDy8y7p6hsE
debug1: load_hostkeys: fopen /home/mt/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: hostkeys_find_by_key_hostfile: hostkeys file /home/mt/.ssh/known_hosts2 does not exist
debug1: hostkeys_find_by_key_hostfile: hostkeys file /etc/ssh/ssh_known_hosts does not exist
debug1: hostkeys_find_by_key_hostfile: hostkeys file /etc/ssh/ssh_known_hosts2 does not exist
debug1: read_passphrase: can't open /dev/tty: Permission denied
ssh_askpass: exec(/usr/lib/ssh/ssh-askpass): No such file or directory
Host key verification failed.  

It's strange that the output says known_hosts2 . This file doesn't exist. Known_hosts has always been used.

"read_passphrase: can't open /dev/tty: Permission denied" is even more confusing.

You were not supposed to run that, I was speculating what might happen.

Create a fresh user, boot the multi-user.target (2nd linkbelow) and log in as the new user.
Do you still run into the askpass error?
Do you when logging in from the multi-user.target as you regular user?

A new user has the same output, but without known_hosts2. Only known_hosts.

seth

Member

From: Don't DM me only for attention

Registered: 2012-09-03

Posts: 73,387

Re: [Solved] SSH client works only by sudo

Ok, your problem is

debug1: read_passphrase: can't open /dev/tty: Permission denied

stat /dev/tty
getfacl /dev/tty

A new user has the same output

At the multi-user.target (ie. console login, no GUI no display manager etc.)?

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

kennyisalive

Member

Registered: 2026-01-26

Posts: 29

Re: [Solved] SSH client works only by sudo

Ok, your problem is

debug1: read_passphrase: can't open /dev/tty: Permission denied

stat /dev/tty
getfacl /dev/tty

  stat /dev/tty                                                                                                       
  File: /dev/tty
  Size: 0         	Blocks: 0          IO Block: 4096   character special file
Device: 0,6	Inode: 11          Links: 1     Device type: 5,0
Access: (0600/crw-------)  Uid: (    0/    root)   Gid: (    5/     tty)
Access: 2026-02-16 14:31:20.000000000 +0300
Modify: 2026-02-16 14:31:20.000000000 +0300
Change: 2026-02-16 14:14:07.159914848 +0300
 Birth: 2026-02-16 17:14:00.219999999 +0300


 getfacl /dev/tty                                                                                                  
getfacl: Removing leading '/' from absolute path names
# file: dev/tty
# owner: root
# group: tty
user::rw-
group::---
other::--- 

A new user has the same output
At the multi-user.target (ie. console login, no GUI no display manager etc.)?

Yes, console. No gui, etc

seth

Member

From: Don't DM me only for attention

Registered: 2012-09-03

Posts: 73,387

Re: [Solved] SSH client works only by sudo

Access: (0600/crw-------)  Uid: (    0/    root)   Gid: (    5/     tty)

Well, yeah.
Why?

tty

Edit: that's a command, run it from wherever you fail to run ssh and post the output.
Are you using something like tmux or screen?

Last edited by seth (2026-02-17 13:56:09)

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

kennyisalive

Member

Registered: 2026-01-26

Posts: 29

Re: [Solved] SSH client works only by sudo

Access: (0600/crw-------)  Uid: (    0/    root)   Gid: (    5/     tty)

Well, yeah.
Why?

tty

Edit: that's a command, run it from wherever you fail to run ssh and post the output.
Are you using something like tmux or screen?

tty output:

 /dev/pts/0 

I am using alacritty

Last edited by kennyisalive (2026-02-24 13:35:17)

seth

Member

From: Don't DM me only for attention

Registered: 2012-09-03

Posts: 73,387

Re: [Solved] SSH client works only by sudo

That doesn't sound wrong at all
Sanity check, is ths WSL?
https://github.com/microsoft/WSL/issues/617

Edit: if not, maybe you have some spurious udev rule?

grep -r tty /{usr/lib,etc}/udev/rules.d/

Last edited by seth (2026-02-24 22:16:48)

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

kennyisalive

Member

Registered: 2026-01-26

Posts: 29

Re: [Solved] SSH client works only by sudo

It's not wsl.

/usr/lib/udev/rules.d/95-upower-wup.rules:SUBSYSTEM=="tty", SUBSYSTEMS=="usb", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6001", ATTRS{serial}=="A80?????", ENV{UPOWER_VENDOR}="Watts Up, Inc.", ENV{UPOWER_PRODUCT}="Watts Up? Pro", ENV{UP_MONITOR_TYPE}="wup"
/usr/lib/udev/rules.d/99-systemd.rules:SUBSYSTEM=="tty", KERNEL=="tty[a-zA-Z]*|hvc*|xvc*|hvsi*|ttysclp*|sclp_line*|3270/tty[0-9]*", TAG+="systemd"
/usr/lib/udev/rules.d/99-systemd.rules:# Exclude 8250 serial ports with a zero IO port, as they are not usable until "setserial /dev/ttySxxx port …" is invoked.
/usr/lib/udev/rules.d/99-systemd.rules:SUBSYSTEM=="tty", KERNEL=="ttyS*", DRIVERS=="serial8250", ATTR{port}=="0x0", ATTR{iomem_base}=="0x0", ENV{SYSTEMD_READY}="0"
/usr/lib/udev/rules.d/65-libwacom.rules:ENV{ID_BUS}=="tty|pnp", ATTRS{id}=="WACf*", ENV{ID_INPUT}="1", ENV{ID_INPUT_TABLET}="1", GOTO="libwacom_end"
/usr/lib/udev/rules.d/65-libwacom.rules:ENV{ID_BUS}=="tty|pnp", ATTRS{id}=="FUJ*", ENV{ID_INPUT}="1", ENV{ID_INPUT_TABLET}="1", GOTO="libwacom_end"
/usr/lib/udev/rules.d/50-udev-default.rules:SUBSYSTEM=="tty", KERNEL=="ptmx", GROUP="tty", MODE="0666"
/usr/lib/udev/rules.d/50-udev-default.rules:SUBSYSTEM=="tty", KERNEL=="tty", GROUP="tty", MODE="0666"
/usr/lib/udev/rules.d/50-udev-default.rules:SUBSYSTEM=="tty", KERNEL=="tty[0-9]*|hvc[0-9]*|sclp_line[0-9]*|ttysclp[0-9]*|3270/tty[0-9]*", GROUP="tty", MODE="0600"
/usr/lib/udev/rules.d/50-udev-default.rules:SUBSYSTEM=="vc", KERNEL=="vcs*|vcsa*", GROUP="tty"
/usr/lib/udev/rules.d/50-udev-default.rules:KERNEL=="tty[A-Z]*[0-9]|ttymxc[0-9]*|pppox[0-9]*|ircomm[0-9]*|noz[0-9]*|rfcomm[0-9]*", GROUP="uucp"
/usr/lib/udev/rules.d/60-serial.rules:SUBSYSTEM!="tty", GOTO="serial_end"
/usr/lib/udev/rules.d/60-serial.rules:KERNEL!="ttyUSB[0-9]*|ttyACM[0-9]*", GOTO="serial_end"
/usr/lib/udev/rules.d/25-gpsd-usb.rules:# The rules in this file handle devices in subsystems "tty" and
/usr/lib/udev/rules.d/25-gpsd-usb.rules:# USB ports use the "tty" subsystem, not the "gnss subsystem.  Unless
/usr/lib/udev/rules.d/25-gpsd-usb.rules:SUBSYSTEM!="gnss", GOTO="gpsd_tty_rules"
/usr/lib/udev/rules.d/25-gpsd-usb.rules:# SUBSYSTEM "tty"
/usr/lib/udev/rules.d/25-gpsd-usb.rules:# The rules in this section only apply to subsystem "tty".
/usr/lib/udev/rules.d/25-gpsd-usb.rules:# Subsystem "tty" includes most of the traditional /dev/ttyXX devices.
/usr/lib/udev/rules.d/25-gpsd-usb.rules:LABEL="gpsd_tty_rules"
/usr/lib/udev/rules.d/25-gpsd-usb.rules:SUBSYSTEM!="tty", GOTO="gpsd_rules_end"
/usr/lib/udev/rules.d/70-uaccess.rules:ENV{ID_SIGNAL_ANALYZER}=="?*", KERNEL=="ttyACM[0-9]*", TAG+="uaccess"

seth

Member

From: Don't DM me only for attention

Registered: 2012-09-03

Posts: 73,387

Re: [Solved] SSH client works only by sudo

The only things not absolute standard would be upower and gpsd,  the latter being a dependency for waybar so unlikely to break tty access?

Tbc, this is bare metal? No VM, no docker, no crostini, no nothing?

sudo LC_ALL=C pacman -Qkk | grep -v ', 0 altered files' | grep -v backup

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 493

Re: [Solved] SSH client works only by sudo

                                                                                                     
  File: /dev/tty
...
Access: (0600/crw-------)

In /etc/udev/udev.conf set "udev_log=debug", then reboot and show output of

$ SYSTEMD_COLORS='' journalctl -b | grep ': tty:'

kennyisalive

Member

Registered: 2026-01-26

Posts: 29

Re: [Solved] SSH client works only by sudo

The only things not absolute standard would be upower and gpsd,  the latter being a dependency for waybar so unlikely to break tty access?

I think no. I killed waybar (well suddenly) and tried connect via ssh, and same: read_passphrase: can't open /dev/tty: Permission denied.

Tbc, this is bare metal? No VM, no docker, no crostini, no nothing?

sudo LC_ALL=C pacman -Qkk | grep -v ', 0 altered files' | grep -v backup

Bare metal. None of the above. Problem was started after some update. I can't remember what exactly was updated.

warning: cups: /etc/cups/classes.conf (Permissions mismatch)
warning: cups: /etc/cups/printers.conf (Permissions mismatch)
warning: java-runtime-common: /usr/lib/jvm/default (Symlink path mismatch)
warning: java-runtime-common: /usr/lib/jvm/default (Modification time mismatch)
warning: java-runtime-common: /usr/lib/jvm/default-runtime (Symlink path mismatch)
warning: java-runtime-common: /usr/lib/jvm/default-runtime (Modification time mismatch)
warning: libutempter: /usr/lib/utempter/utempter (GID mismatch)
warning: libutempter: /usr/lib/utempter/utempter (Permissions mismatch)
warning: libvlc: /usr/lib/vlc/plugins/plugins.dat (Modification time mismatch)
warning: libvlc: /usr/lib/vlc/plugins/plugins.dat (Size mismatch)
warning: libvlc: /usr/lib/vlc/plugins/plugins.dat (SHA256 checksum mismatch)
warning: lidm: /etc/lidm.ini (Modification time mismatch)
warning: lidm: /etc/lidm.ini (Size mismatch)
warning: lidm: /etc/lidm.ini (SHA256 checksum mismatch)
warning: nodejs-nopt: /usr/bin/nopt (Permissions mismatch)
cups: 947 total files, 2 altered files
java-runtime-common: 21 total files, 2 altered files
libutempter: 20 total files, 1 altered file
libvlc: 120 total files, 1 altered file
lidm: 11 total files, 1 altered file
warning: pass: /usr/bin/pass (Modification time mismatch)
warning: pass: /usr/bin/pass (Size mismatch)
warning: pass: /usr/bin/pass (SHA256 checksum mismatch)
warning: passim: /var/lib/passim (UID mismatch)
warning: passim: /var/lib/passim (GID mismatch)
warning: passim: /var/lib/passim/data (UID mismatch)
warning: passim: /var/lib/passim/data (GID mismatch)
warning: postfix: /usr/bin/postdrop (GID mismatch)
warning: postfix: /usr/bin/postdrop (Permissions mismatch)
warning: postfix: /usr/bin/postqueue (GID mismatch)
warning: postfix: /usr/bin/postqueue (Permissions mismatch)
warning: postfix: /var/lib/postfix (UID mismatch)
warning: postfix: /var/spool/postfix/active (UID mismatch)
warning: postfix: /var/spool/postfix/bounce (UID mismatch)
warning: postfix: /var/spool/postfix/corrupt (UID mismatch)
warning: postfix: /var/spool/postfix/defer (UID mismatch)
warning: postfix: /var/spool/postfix/deferred (UID mismatch)
warning: postfix: /var/spool/postfix/flush (UID mismatch)
warning: postfix: /var/spool/postfix/hold (UID mismatch)
warning: postfix: /var/spool/postfix/incoming (UID mismatch)
warning: postfix: /var/spool/postfix/maildrop (UID mismatch)
warning: postfix: /var/spool/postfix/maildrop (GID mismatch)
warning: postfix: /var/spool/postfix/private (UID mismatch)
warning: postfix: /var/spool/postfix/public (UID mismatch)
warning: postfix: /var/spool/postfix/public (GID mismatch)
warning: postfix: /var/spool/postfix/saved (UID mismatch)
warning: postfix: /var/spool/postfix/trace (UID mismatch)
warning: shadow: /usr/bin/groupmems (GID mismatch)
warning: shadow: /usr/bin/groupmems (Permissions mismatch)
warning: systemd: /var/log/journal (GID mismatch)
warning: wineland: /usr/lib/wineland/ui/start-civetweb-local (UID mismatch)
warning: wineland: /usr/lib/wineland/ui/start-civetweb-local (GID mismatch)
warning: wineland: /usr/lib/wineland/ui/start-civetweb-local (Modification time mismatch)
warning: wineland: /usr/lib/wineland/ui/start-civetweb-local (Size mismatch)
warning: wineland: /usr/lib/wineland/ui/start-civetweb-local (SHA256 checksum mismatch)
nodejs-nopt: 30 total files, 1 altered file
pass: 24 total files, 1 altered file
passim: 86 total files, 2 altered files
postfix: 256 total files, 16 altered files
shadow: 576 total files, 1 altered file
systemd: 1727 total files, 1 altered file
wineland: 34 total files, 1 altered file

Last edited by kennyisalive (2026-03-02 06:24:17)

kennyisalive

Member

Registered: 2026-01-26

Posts: 29

Re: [Solved] SSH client works only by sudo

                                                                                                     
  File: /dev/tty
...
Access: (0600/crw-------)

In /etc/udev/udev.conf set "udev_log=debug", then reboot and show output of

$ SYSTEMD_COLORS='' journalctl -b | grep ': tty:'

Hello! Thanks for reply! Output:

мар 02 09:25:53 dwarch udevadm[383]: tty: Triggered device with action 'add'.
мар 02 09:25:53 dwarch systemd-udevd[415]: tty: Device is queued (SEQNUM=3770, ACTION=add, UUID=215b2cb6-2315-4a5e-9408-460b2ab61455)
мар 02 09:25:53 dwarch systemd-udevd[415]: tty: Device ready for processing (SEQNUM=3770, ACTION=add, UUID=215b2cb6-2315-4a5e-9408-460b2ab61455)
мар 02 09:25:53 dwarch systemd-udevd[415]: tty: sd-device-monitor(manager): Passed 253 byte to netlink monitor.
мар 02 09:25:53 dwarch (udev-worker)[452]: tty: Processing device (SEQNUM=3770, ACTION=add, UUID=215b2cb6-2315-4a5e-9408-460b2ab61455)
мар 02 09:25:53 dwarch (udev-worker)[452]: tty: /usr/lib/udev/rules.d/50-udev-default.rules:44 GROUP="tty": Set group ID: 5
мар 02 09:25:53 dwarch (udev-worker)[452]: tty: /usr/lib/udev/rules.d/50-udev-default.rules:44 MODE="0666": Set mode: 0666
мар 02 09:25:53 dwarch (udev-worker)[452]: tty: Setting permissions /dev/tty, uid=0, gid=5, mode=0666
мар 02 09:25:53 dwarch (udev-worker)[452]: tty: Successfully created symlink '/dev/char/5:0' to '/dev/tty'
мар 02 09:25:53 dwarch (udev-worker)[452]: tty: sd-device: Created database file '/run/udev/data/c5:0' for '/devices/virtual/tty/tty'.
мар 02 09:25:53 dwarch (udev-worker)[452]: tty: sd-device: Created database file '/run/udev/data/c5:0' for '/devices/virtual/tty/tty'.
мар 02 09:25:53 dwarch (udev-worker)[452]: tty: Device processed (SEQNUM=3770, ACTION=add, UUID=215b2cb6-2315-4a5e-9408-460b2ab61455)
мар 02 09:25:53 dwarch (udev-worker)[452]: tty: sd-device-monitor(worker): Passed 253 byte to netlink monitor.

seth

Member

From: Don't DM me only for attention

Registered: 2012-09-03

Posts: 73,387

Re: [Solved] SSH client works only by sudo

I killed waybar

You would have had to have removed the packages providing the less-than-supercommon rules but w/ #38 it doesn't seem to be a udev rule anyway.
It's also not a compromised package.

mount | grep '/dev'
grep -r  tty /{usr/lib,etc}/tmpfiles.d

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 493

Re: [Solved] SSH client works only by sudo

Output

At least we know that invalid permissions aren't set by some udev rule. Don't forget to delete "udev_log=debug" from udev.conf and reload the service with "systemctl reload systemd-udevd" if udev's debug info is no longer needed.

kennyisalive

Member

Registered: 2026-01-26

Posts: 29

Re: [Solved] SSH client works only by sudo

Output

At least we know that invalid permissions aren't set by some udev rule. Don't forget to delete "udev_log=debug" from udev.conf and reload the service with "systemctl reload systemd-udevd" if udev's debug info is no longer needed.

Thanks. Now I just need to figure out who's blocking access to the tty.

seth

Member

From: Don't DM me only for attention

Registered: 2012-09-03

Posts: 73,387

Re: [Solved] SSH client works only by sudo

See #39 and check mount options and systemd tempfiles

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

kennyisalive

Member

Registered: 2026-01-26

Posts: 29

Re: [Solved] SSH client works only by sudo

I killed waybar

mount | grep '/dev'
grep -r  tty /{usr/lib,etc}/tmpfiles.d

mount | grep '/dev'  :

dev on /dev type devtmpfs (rw,nosuid,relatime,size=8015456k,nr_inodes=2003864,mode=755,inode64)
/dev/mapper/arch-root on / type ext4 (rw,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,inode64,usrquota)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=600,ptmxmode=000)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,nosuid,nodev,relatime,pagesize=2M)
/dev/nvme0n1p3 on /windows type fuseblk (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other,blksize=4096)
/dev/mapper/arch-home on /home type ext4 (rw,relatime)
/dev/nvme0n1p1 on /boot type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro)

grep -r  tty /{usr/lib,etc}/tmpfiles.d :

/usr/lib/tmpfiles.d/arch.conf:C /etc/securetty

seth

Member

From: Don't DM me only for attention

Registered: 2012-09-03

Posts: 73,387

Re: [Solved] SSH client works only by sudo

Nope, bog standard…
If you only boot the multi-user.target (2nd link below) and login as root (or better: a new user account), is "stat /dev/tty" still 600 ?

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

kennyisalive

Member

Registered: 2026-01-26

Posts: 29

Re: [Solved] SSH client works only by sudo

Nope, bog standard…
If you only boot the multi-user.target (2nd link below) and login as root (or better: a new user account), is "stat /dev/tty" still 600 ?

I rebooted in multi-user.target, logon as root and still Access (0600/crw-------)

seth

Member

From: Don't DM me only for attention

Registered: 2012-09-03

Posts: 73,387

Re: [Solved] SSH client works only by sudo

https://wiki.archlinux.org/title/Audit_ … ies_access

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

kennyisalive

Member

Registered: 2026-01-26

Posts: 29

Re: [Solved] SSH client works only by sudo

https://wiki.archlinux.org/title/Audit_ … ies_access

While I'm reading the link, it's strange that:

Error opening /var/log/audit/audit.log (No such file or directory)

Should this file be created by default?

UPD: fixit. service auditd was not started.

Last edited by kennyisalive (2026-03-03 09:15:39)

kennyisalive

Member

Registered: 2026-01-26

Posts: 29

Re: [Solved] SSH client works only by sudo

still Access (0600/crw-------)

can i just set

chmod 666 /dev/tty

? Is it safe?

kennyisalive

Member

Registered: 2026-01-26

Posts: 29

Re: [Solved] SSH client works only by sudo

https://wiki.archlinux.org/title/Audit_ … ies_access

Did I understand correctly that you are suggesting to add /dev/tty to auditd monitoring?

seth

Member

From: Don't DM me only for attention

Registered: 2012-09-03

Posts: 73,387

Re: [Solved] SSH client works only by sudo

Did I understand correctly that you are suggesting to add /dev/tty to auditd monitoring?

That was the plan - there's unfortunately no guarantee this works (/dev/tty is special per-process) and it will possibly generate an enormous log but I've no better idea to figure why you end up w/ the bogus permissions since we looked at the usual suspects.

On a limb, please post your complete system journal for the boot:

sudo journalctl -b | curl -F 'file=@-' 0x0.st

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc