ssh drops privs when it can't find ~/.ssh/prng_seed

[Andrew Stribblehill]

I'm using OpenSSH 2.3.0p1. When my users use ssh for the first
time, using rhosts authentication, entropy.c drops the privs in
prng_write_seedfile() at the setuid(original_uid) line (line 550,
approx):

void
prng_write_seedfile(void) {
	int fd;
	char seed[1024];
	char filename[1024];
	struct passwd *pw;

	/* Don't bother if we have already saved a seed */
	if (prng_seed_saved)
		return;
	
	setuid(original_uid);
/*      ^^^^^^^^^^^^^^^^^^^^     ***HERE*** */

	prng_seed_saved = 1;
	
	pw = getpwuid(original_uid);
	if (pw == NULL)
		fatal("Couldn't get password entry for current user (%i): %s", 
			original_uid, strerror(errno));
				
	/* Try to ensure that the parent directory is there */
	snprintf(filename, sizeof(filename), "%.512s/%s", pw->pw_dir, 
		SSH_USER_DIR);
	mkdir(filename, 0700);

	snprintf(filename, sizeof(filename), "%.512s/%s", pw->pw_dir, 
		SSH_PRNG_SEED_FILE);

	debug("writing PRNG seed to file %.100s", filename);

	RAND_bytes(seed, sizeof(seed));

	/* Don't care if the seed doesn't exist */
	prng_check_seedfile(filename);
	
	if ((fd = open(filename, O_WRONLY|O_TRUNC|O_CREAT, 0600)) == -1) {
		debug("WARNING: couldn't access PRNG seedfile %.100s (%.100s)", 
		   filename, strerror(errno));
	} else {	
		if (atomicio(write, fd, &seed, sizeof(seed)) != sizeof(seed))
			fatal("problem writing PRNG seedfile %.100s (%.100s)", filename, 
				 strerror(errno));

		close(fd);
	}
}


Can anyone explain firstly why it does this, and secondly how I
can stop it?

Thanks,

Andrew Stribblehill
Systems programmer, IT Service, University of Durham, England