Privilege separation

Darren Tucker dtucker at
Wed Oct 29 21:01:14 EST 2003

Logu wrote:
> I do not understand why there is a runtime option not to use privilege
> separation. What if the previlege separation is made compulsary.

Not all platforms and configurations work with privsep.  (Example:
*really* early Linuxes have a broken mmap(), so Compression isn't usable
with privilege separation.)

It also increases the memory footprint (2 sshd's per connection rather
than 1), this may make a difference on heavily-loaded or memory-starved

Darren Tucker (dtucker at
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

More information about the openssh-unix-dev mailing list