A question about OpenSSH_3.4p1 on Solaris 8

[Lacoss-Arnold, Jason]

The only time that I think a person should be concerned is if you have a
very constrained process table and a lot of users.  It will take up extra
process table entries, but that should be about it.

-----Original Message-----
From: William R. Knox
To: Roger Wang
Cc: openssh-unix-dev at mindrot.org
Sent: 10/25/02 12:50 PM
Subject: Re: A question about OpenSSH_3.4p1 on Solaris 8

I assume that the CPU overhead of splitting the processing into the two
separate processes involves only the communication between the
processes,
given that the root process only handled things that have to be handled
by
root and the user-owned process takes care of everything else -
therefore,
there should be VERY little increased load as a result of privilege
separation (which you can turn off as well, if you like) and only a
limited additional memory use (for the additional process). Worth it for
the protection, I think.

			Bill Knox
			Senior Operating Systems Programmer/Analyst
			The MITRE Corporation

On Fri, 25 Oct 2002, Ben Lindstrom wrote:

> Date: Fri, 25 Oct 2002 10:53:38 -0500 (CDT)
> From: Ben Lindstrom <mouring at etoh.eviladmin.org>
> To: Roger Wang <xiwang17 at yahoo.com>
> Cc: openssh-unix-dev at mindrot.org
> Subject: Re: A question about OpenSSH_3.4p1 on Solaris 8
>
>
>
>
> On Fri, 25 Oct 2002, Roger Wang wrote:
>
> > Ben, thanks for the reply.
> >
> > What made me curious is there is only one "sshd"
> > daemon generated for commecial SSH - I'm testing both
> > commecial SSH and openSSH.
> >
>
> The reason is the commerical version of ssh lumps all root critical
and
> non root critical code into one process.  They step up or down the
> security as they need it.   In the past such designs have proven that
any
> slighest buffer overflow or bad coding can/will cause a comprised
server.
>
> > Appreciate if you can give more input on this. I have
> > concern about the performance impact of "sshd".
> >
>
> Never benchmarked it.. But I see one BSD server I connect to has 33
people
> on it and who knows what else is running on it.  It seems to be doing
> very well (0.33 load or less).  Not dead sure what hardware, but I
know it
> is intel and not multiple processors.
>
> - Ben
>
> _______________________________________________
> openssh-unix-dev at mindrot.org mailing list
> http://www.mindrot.org/mailman/listinfo/openssh-unix-dev
>

_______________________________________________
openssh-unix-dev at mindrot.org mailing list
http://www.mindrot.org/mailman/listinfo/openssh-unix-dev


***********************************************************************************
WARNING:  All e-mail sent to and from this address will be received or
otherwise recorded by the A.G. Edwards corporate e-mail system and is
subject to archival, monitoring or review by, and/or disclosure to,
someone other than the recipient.
************************************************************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20021025/d7b413bf/attachment.html