Fixing OpenSSH Daemon Failures on NixOS: A Step‑by‑Step Diagnostic Guide

Problem Statement

When the OpenSSH daemon (sshd.service) fails to start on a NixOS system, you usually see a short systemd failure message and the service remains inactive. The issue can stem from mis‑configured host key paths, wrong file permissions, a missing package, or a conflicting configuration that masks the unit. This guide walks you through the most common causes, how to detect them, and how to apply the appropriate fix.

Quick Cause‑to‑Message Table

Condition	Typical Journal Message	Likely Cause
sshd.service inactive	Failed to load host key	Invalid services.openssh.hostKeys paths or missing files
sshd.service inactive	Bad permissions	Host key files are too open or owned by the wrong user
sshd.service inactive	Unit is masked	Another module disables the service
sshd.service inactive	Dependency failed for OpenSSH Daemon	Required systemd unit (e.g., sshd.socket) is masked or failed
sshd.service inactive	File not found	OpenSSH package missing or broken store link

Ordered Diagnostics

1. Check the unit status

   # systemctl status sshd.service
   

   Run as root. Look for the Active: line and any failure messages.

2. Inspect the journal

   # journalctl -u sshd.service -b | tail -n 20
   

   Search for Failed to load host key, Bad permissions, or Dependency failed. This narrows the root cause.

3. Verify host key configuration

   # grep -R "services.openssh.hostKeys" /etc/nixos/configuration.nix
   

   Confirm that the paths listed actually exist. A typical default looks like:

   services.openssh.hostKeys = [ "/etc/ssh/ssh_host_rsa_key" "/etc/ssh/ssh_host_ed25519_key" ];
   

4. Check key file existence and permissions

   # ls -l /etc/ssh/ssh_host_*_key
   

   Keys must be owned by root and have mode 0600. If permissions are 0644 or ownership differs, sshd will refuse to start.

5. Confirm OpenSSH package is present

   # nix-env -q openssh
   # nix-store --query --requisites /run/current-system/sw/bin/sshd | wc -l
   

   The first command should list openssh as an installed package. The second ensures the binary’s store path exists.

6. Check for service masking or override

   # systemctl list-unit-files | grep sshd
   

   If the output shows masked, run systemctl unmask sshd.service and then systemctl enable sshd.service.

7. Verify systemd dependencies

   # systemctl status sshd.socket
   

   Ensure the socket unit is active or at least not masked. If it is masked, unmask it and re‑enable the daemon.

Fixes Tied to Findings

• Missing or wrong host key paths – Edit /etc/nixos/configuration.nix to point to valid keys, then run nixos-rebuild switch.
• Bad key file permissions – Correct them:

  # chown root:root /etc/ssh/ssh_host_*_key
  # chmod 600 /etc/ssh/ssh_host_*_key
  

  Then restart sshd.service.
• Service masked or disabled – Unmask and enable:

  # systemctl unmask sshd.service
  # systemctl enable sshd.service
  # systemctl start sshd.service
  

• Missing OpenSSH package – Add it to your configuration:

  environment.systemPackages = [ pkgs.openssh ];
  

  Then rebuild.
• Dependency failure – Unmask the required unit (e.g., sshd.socket) and ensure it is enabled.

Verification After Fix

Run systemctl status sshd.service again. The output should read Active: active (running). A quick test is to SSH into the host from another machine:

ssh user@your-nixos-host

If the connection succeeds, the daemon is operational. If not, re‑examine the journal for new error messages.

Escalation Criteria

• After all above checks, sshd.service still fails with Failed to start OpenSSH Daemon.
• The journal contains cryptic messages not covered in the table (e.g., invalid configuration option).
• You have modified configuration.nix recently and cannot reproduce the problem after a clean rebuild.

At this point, consider opening an issue on the NixOS GitHub repository or consulting the NixOS Discourse community. Provide the journal snippet, the relevant configuration.nix section, and the NixOS version (nixos-version).