diff --git a/hkexshd/hkexshd.go b/hkexshd/hkexshd.go
index bae163e..5fbb77e 100644
--- a/hkexshd/hkexshd.go
+++ b/hkexshd/hkexshd.go
@@ -200,6 +200,13 @@ func main() {
 		log.SetOutput(ioutil.Discard)
 	}
 
+	{
+		me, e := user.Current()
+		if e != nil || me.Uid != "0" {
+			log.Fatal("Must run as root.")
+		}
+	}
+
 	// Listen on TCP port 2000 on all available unicast and
 	// anycast IP addresses of the local system.
 	l, err := hkexsh.Listen("tcp", laddr)