README.privsep

[Ben Lindstrom]

Maybe we should state how to change the user and the chroot before the
step by step.  I can see someone changing the privsep user and whining
about things not work.

- Ben

On Mon, 24 Jun 2002, Kevin Steves wrote:

> Hi,
>
> This is included in the release now; any feedback?
>
> Privilege separation, or privsep, is method in OpenSSH by which
> operations that require root privilege are performed by a separate
> privileged monitor process.  Its purpose is to prevent privilege
> escalation by containing corruption to an unprivileged process.
> More information is available at:
> 	http://www.citi.umich.edu/u/provos/ssh/privsep.html
>
> Privilege separation is now enabled by default; see the
> UsePrivilegeSeparation option in sshd_config(5).
>
> On systems which lack mmap or anonymous (MAP_ANON) memory mapping,
> compression must be disabled in order for privilege separation to
> function.
>
> When privsep is enabled, during the pre-authentication phase sshd will
> chroot(2) to "/var/empty" and change its privileges to the "sshd" user
> and its primary group.  You should do something like the following to
> prepare the privsep preauth environment:
>
> 	# mkdir /var/empty
> 	# chown root:sys /var/empty
> 	# chmod 755 /var/empty
> 	# groupadd sshd
> 	# useradd -g sshd -c 'sshd privsep' -d /var/empty sshd
>
> If you are on UnixWare 7 or OpenUNIX 8 do this additional step.
> 	# ln /usr/lib/.ns.so /usr/lib/ns.so.1
>
> /var/empty should not contain any files.
>
> configure supports the following options to change the default
> privsep user and chroot directory:
>
>   --with-privsep-path=xxx Path for privilege separation chroot
>   --with-privsep-user=user Specify non-privileged user for privilege separation
>
> Privsep requires operating system support for file descriptor passing
> and mmap(MAP_ANON).
>
> PAM-enabled OpenSSH is known to function with privsep on Linux.
> It does not function on HP-UX with a trusted system
> configuration.  PAMAuthenticationViaKbdInt does not function with
> privsep.
>
> Note that for a normal interactive login with a shell, enabling privsep
> will require 1 additional process per login session.
>
> Given the following process listing (from HP-UX):
>
>      UID   PID  PPID  C    STIME TTY       TIME COMMAND
>     root  1005     1  0 10:45:17 ?         0:08 /opt/openssh/sbin/sshd -u0
>     root  6917  1005  0 15:19:16 ?         0:00 sshd: stevesk [priv]
>  stevesk  6919  6917  0 15:19:17 ?         0:03 sshd: stevesk at 2
>  stevesk  6921  6919  0 15:19:17 pts/2     0:00 -bash
>
> process 1005 is the sshd process listening for new connections.
> process 6917 is the privileged monitor process, 6919 is the user owned
> sshd process and 6921 is the shell process.
>
> $Id: README.privsep,v 1.8 2002/06/24 16:49:22 stevesk Exp $
> _______________________________________________
> openssh-unix-dev at mindrot.org mailing list
> http://www.mindrot.org/mailman/listinfo/openssh-unix-dev
>