diff --git a/cmd/config_serve_stdinserver.go b/cmd/config_serve_stdinserver.go
index a68c1d4..0301ae3 100644
--- a/cmd/config_serve_stdinserver.go
+++ b/cmd/config_serve_stdinserver.go
@@ -8,7 +8,6 @@ import (
 	"net"
 	"os"
 	"path"
-	"path/filepath"
 )
 
 type StdinserverListenerFactory struct {
@@ -47,20 +46,7 @@ func stdinserverListenerSocket(sockdir, clientIdentity string) (addr *net.UnixAd
 
 func (f *StdinserverListenerFactory) Listen() (al AuthenticatedChannelListener, err error) {
 
-	sockdir := filepath.Dir(f.sockaddr.Name)
-	sdstat, err := os.Stat(sockdir)
-	if err != nil {
-		return nil, errors.Wrapf(err, "cannot stat(2) sockdir '%s'", sockdir)
-	}
-	if !sdstat.IsDir() {
-		return nil, errors.Errorf("sockdir is not a directory: %s", sockdir)
-	}
-	p := sdstat.Mode().Perm()
-	if p&0007 != 0 {
-		return nil, errors.Errorf("sockdir must not be world-accessible (permissions are %#o)", p)
-	}
-
-	ul, err := net.ListenUnix("unix", f.sockaddr)
+	ul, err := ListenUnixPrivate(f.sockaddr)
 	if err != nil {
 		return nil, errors.Wrapf(err, "cannot listen on unix socket %s", f.sockaddr)
 	}
diff --git a/cmd/helpers.go b/cmd/helpers.go
new file mode 100644
index 0000000..d999195
--- /dev/null
+++ b/cmd/helpers.go
@@ -0,0 +1,26 @@
+package cmd
+
+import (
+	"github.com/pkg/errors"
+	"net"
+	"os"
+	"path/filepath"
+)
+
+func ListenUnixPrivate(sockaddr *net.UnixAddr) (*net.UnixListener, error) {
+
+	sockdir := filepath.Dir(sockaddr.Name)
+	sdstat, err := os.Stat(sockdir)
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot stat(2) '%s'", sockdir)
+	}
+	if !sdstat.IsDir() {
+		return nil, errors.Errorf("%s is not a directory: %s", sockdir)
+	}
+	p := sdstat.Mode().Perm()
+	if p&0007 != 0 {
+		return nil, errors.Errorf("%s must not be world-accessible (permissions are %#o)", p)
+	}
+
+	return net.ListenUnix("unix", sockaddr)
+}