Creating a second instance of the sshd service

System Administrators often need to configure and run multiple instances of a service. This is done by creating copies of the original service configuration files and modifying certain parameters to avoid conflicts with the primary instance of the service. The following procedure shows how to create a second instance of the sshd service:

  1. Create a copy of the sshd_config file that will be used by the second daemon:

    ~]# cp /etc/ssh/sshd{,-second}_config

  2. Edit the sshd-second_config file created in the previous step to assign a different port number and PID file to the second daemon:

    Port 22220
    PidFile /var/run/sshd-second.pid

    See the sshd_config(5) manual page for more information on Port and PidFile options. Make sure the port you choose is not in use by any other service. The PID file does not have to exist before running the service, it is generated automatically on service start.

  3. Create a copy of the systemd unit file for the sshd service:

    ~]# cp /usr/lib/systemd/system/sshd.service /etc/systemd/system/sshd-second.service

  4. Alter the sshd-second.service created in the previous step as follows:
    a. Modify the Description option:

    Description=OpenSSH server second instance daemon

    b. Add sshd.service to services specified in the After option, so that the second instance starts only after the first one has already started:

    After=syslog.target network.target auditd.service sshd.service

    c. The first instance of sshd includes key generation, therefore remove the ExecStartPre=/usr/sbin/sshd-keygen line.

    d. Add the -f /etc/ssh/sshd-second_config parameter to the sshd command, so that the alternative configuration file is used:

    ExecStart=/usr/sbin/sshd -D -f /etc/ssh/sshd-second_config $OPTIONS

    e. After the above modifications, the sshd-second.service should look as follows:

    [Unit]
    Description=OpenSSH server second instance daemon
    After=syslog.target network.target auditd.service sshd.service
    [Service]
    EnvironmentFile=/etc/sysconfig/sshd
    ExecStart=/usr/sbin/sshd -D -f /etc/ssh/sshd-second_config $OPTIONS
    ExecReload=/bin/kill -HUP $MAINPID
    KillMode=process
    Restart=on-failure
    RestartSec=42s
    [Install]
    WantedBy=multi-user.target

  5. If using SELinux, add the port for the second instance of sshd to SSH ports, otherwise the second instance of sshd will be rejected to bind to the port:

    ~]# semanage port -a -t ssh_port_t -p tcp 22220

  6. Enable sshd-second.service, so that it starts automatically upon boot:

    ~]# systemctl enable sshd-second.service

  7. Verify if the sshd-second.service is running by using the systemctl status command. Also, verify if the port is enabled correctly by connecting to the service:

    ~]$ ssh -p 22220 user@server

  8. If the firewall is in use, make sure that it is configured appropriately in order to allow connections to the second instance of sshd.

    ~]# firewall-cmd --add-port=22220/tcp