> Source: [sk180435](https://support.checkpoint.com/results/sk/sk180435)

# sk180435 - "sshd[PID]: fatal: Privilege separation user sshd does not exist" error in /var/log/messages file

| Property | Value |
|----------|-------|
| Solution ID | sk180435 |
| Date Created | 2022-12-29 |
| Last Modified | 2024-07-10 |
| Technical Level | Advanced |
| Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server |
| Versions | R81.20, R81.10 (EOS), R81.20, R81 (EOS), R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20 |
| OS | Gaia |

## Symptoms

- * You can not access the Gaia server over SSH, although SSH is allowed in the Access Control Policy rules.

* The error "*sshd\[\<PID\>\]: fatal: Privilege separation user sshd does not exist* " appears in */var/log/messages* file every time there is an attempt to log in to Gaia OS over SSH.

* The */etc/passwd* file on the Gaia server does not contain a user named "`sshd`".

* In the */config/active* file, many lines are missing for "`passwd:sshd`" settings.

## Cause

The SSHD process restarts from time to time when it receives Linux signal 15, which is the usual behavior.

The SSHD process does not close existing connections when it restarts. When it terminates, the user "SSHD" is deleted from the */etc/passwd* file.

Example (in the */var/log/secure* file):

`[Date Time] GW sshd[13107]: Received signal 15; terminating.`  
`[Date Time] GW groupadd[14696]: new group: name=sshd, GID=74`  
`[Date Time] GW useradd[14701]: new user: name=sshd, UID=74, GID=74, home=/var/empty/sshd, shell=/sbin/nologin`  
`[Date Time] GW sshd[14710]: Server listening on 0.0.0.0 port 22.`

The processes *groupadd* and *useradd* are responsible for adding a new "SSHD" user back to the */etc/passwd* file.

This issue is rare and occurs when the *useradd* process does not add the SSHD user to the */etc/passwd* file.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content