UsePrivilegeSeparation doesn t work on Linux 2.2.x [Re: OpenSSH 3.2.2 released]

[Denis Ducamp]

On Fri, May 17, 2002 at 12:36:22AM +0200, Markus Friedl wrote:
> - experimental support for privilege separation,
>   see UsePrivilegeSeparation in sshd(8) and
> 	  http://www.citi.umich.edu/u/provos/ssh/privsep.html
>   for more information.

This is a very good feature and I want to thanks again Niels Provos and
others for their work on it.

I tested it during snapshot and worked well on my non-production systems but
this morning I couldn't make it work on some of my production systems. In
fact the difference is the linux kernel version : 2.4.x vs 2.2.x

UsePrivilegeSeparation work on all my slackware 8.0 linux 2.4.17 glibc 2.2.3
UsePrivilegeSeparation doesn't work on following systems with the same
result :
. slackware 7.1-cur linux 2.2.19pre16 glibc 2.2.2
. slackware 7.1 linux 2.2.19 glibc 2.1.3
. redhat 6.0 linux 2.2.19 glibc 2.1.1
. debian 3.0 linux 2.2.20 glibc 2.2.5

All configured with :
./configure --with-tcp-wrappers --with-ssl-dir=/usr/local/ssl --with-md5-passwords --disable-suid-ssh

Here is the sshd dump :
root at server:openssh-3.2.2p1# ./sshd -p 28 -d -D -o 'UsePrivilegeSeparation yes'
debug1: sshd version OpenSSH_3.2.2p1
debug1: private host key: #0 type 0 RSA1
debug1: read PEM private key done: type RSA
debug1: private host key: #1 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #2 type 2 DSA
socket: Address family not supported by protocol
debug1: Bind to port 28 on 0.0.0.0.
Server listening on 0.0.0.0 port 28.
Generating 768 bit RSA key.
RSA key generation complete.

debug1: Server will not fork when running in debugging mode.
setsid: Operation not permitted
Connection from 62.4.21.62 port 3247
debug1: Client protocol version 2.0; client software version OpenSSH_3.2.2p1
debug1: match: OpenSSH_3.2.2p1 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-1.99-OpenSSH_3.2.2p1
mmap(65536)
debug1: Calling cleanup 0x8068954(0x0)
root at server:openssh-3.2.2p1# 

Here is what strace can see (on the debian system) :
fcntl(4, F_SETFL, O_RDONLY|O_NONBLOCK)  = 0
socketpair(PF_UNIX, SOCK_STREAM, 0, [3, 7]) = 0
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
fcntl(7, F_SETFD, FD_CLOEXEC)           = 0
mmap2(NULL, 65536, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANONYMOUS, -1, 0) = -1 ENOSYS (Function not implemented)
old_mmap(NULL, 65536, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANONYMOUS, -1, 0) = -1 EINVAL (Invalid argument)
write(2, "mmap(65536)\r\n", 13mmap(65536)
)         = 13
write(2, "debug1: Calling cleanup 0x806ae9"..., 40debug1: Calling cleanup 0x806ae9c(0x0)
) = 40
shutdown(4, 2 /* send and receive */)   = 0
close(4)                                = 0
_exit(255)                              = ?

The connexion is made with a simple 'ssh server -p 28' and the result in the
same in sshv1/2 with publickey/password authentication.

Best regards,

Denis Ducamp.

-- 
 Denis.Ducamp at hsc.fr --- Hervé Schauer Consultants --- http://www.hsc.fr/
 Owl/Openwall/snort/hping/dsniff en français   http://www.groar.org/trad/
            Owl en français    http://www.openwall.com/Owl/fr/
 Du bon usage de ... http://usenet-fr.news.eu.org/fr-chartes/rfc1855.html