A question about OpenSSH_3.4p1 on Solaris 8

[William R. Knox]

I assume that the CPU overhead of splitting the processing into the two
separate processes involves only the communication between the processes,
given that the root process only handled things that have to be handled by
root and the user-owned process takes care of everything else - therefore,
there should be VERY little increased load as a result of privilege
separation (which you can turn off as well, if you like) and only a
limited additional memory use (for the additional process). Worth it for
the protection, I think.

			Bill Knox
			Senior Operating Systems Programmer/Analyst
			The MITRE Corporation

On Fri, 25 Oct 2002, Ben Lindstrom wrote:

> Date: Fri, 25 Oct 2002 10:53:38 -0500 (CDT)
> From: Ben Lindstrom <mouring at etoh.eviladmin.org>
> To: Roger Wang <xiwang17 at yahoo.com>
> Cc: openssh-unix-dev at mindrot.org
> Subject: Re: A question about OpenSSH_3.4p1 on Solaris 8
>
>
>
>
> On Fri, 25 Oct 2002, Roger Wang wrote:
>
> > Ben, thanks for the reply.
> >
> > What made me curious is there is only one "sshd"
> > daemon generated for commecial SSH - I'm testing both
> > commecial SSH and openSSH.
> >
>
> The reason is the commerical version of ssh lumps all root critical and
> non root critical code into one process.  They step up or down the
> security as they need it.   In the past such designs have proven that any
> slighest buffer overflow or bad coding can/will cause a comprised server.
>
> > Appreciate if you can give more input on this. I have
> > concern about the performance impact of "sshd".
> >
>
> Never benchmarked it.. But I see one BSD server I connect to has 33 people
> on it and who knows what else is running on it.  It seems to be doing
> very well (0.33 load or less).  Not dead sure what hardware, but I know it
> is intel and not multiple processors.
>
> - Ben
>
> _______________________________________________
> openssh-unix-dev at mindrot.org mailing list
> http://www.mindrot.org/mailman/listinfo/openssh-unix-dev
>