sshd as non-root

[Darren Tucker]

Damien Miller wrote:
> Correct, don't add a UsePAM=yes to the config (assuming you are using
> 3.7.1p2). On some other platforms, non-root may break platform native
> authentication systems. Darren, can you comment on AIX?

Sure.  AIX has a number of account check functions (eg is the account
locked, is it allowed to log in at this time, that kind of thing) that can
only be checked if the process has root privs [0] because the details
stored in files that aren't world readable. 

Currently, sshd does not perform those tests when running with uid != 0,
since they will always fail.  This was done mainly for the regression
tests, but also acknowledging that their may be legitimate uses for a
non-root sshd.  The previous discussion is in the mail archives.

> I think that all platforms supported by portable OpenSSH require root
> for TTY assignment. I believe that some platforms can get away with
> non-root, but with a sgid helper but we haven't followed that up.

Hm, I though most didn't need root for ptys.  ISTR in the doco for
"expect" they only mention Crays as needing root for ptys.  Redhat 8 seems
to work OK for ssh -t without root, dunno about other platforms.

[0] Actually, uid == 0 or gid "security", although sshd currently does not
check for the latter.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.