Index: ssh-keysign.c
===================================================================
RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/ssh-keysign.c,v
retrieving revision 1.23
diff -u -p -r1.23 ssh-keysign.c
--- ssh-keysign.c	29 Aug 2004 06:32:59 -0000	1.23
+++ ssh-keysign.c	29 Aug 2004 07:41:34 -0000
@@ -45,6 +45,7 @@ RCSID("$OpenBSD: ssh-keysign.c,v 1.18 20
 
 /* XXX readconf.c needs these */
 uid_t original_real_uid;
+uid_t original_effective_uid;
 
 extern char *__progname;
 
@@ -152,11 +153,13 @@ main(int argc, char **argv)
 	key_fd[1] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY);
 
 	original_real_uid = getuid();	/* XXX readconf.c needs this */
+	original_effective_uid = geteuid();
 	if ((pw = getpwuid(original_real_uid)) == NULL)
 		fatal("getpwuid failed");
 	pw = pwcopy(pw);
 
-	permanently_set_uid(pw);
+	if (original_real_uid == 0 && original_effective_uid != 0)
+		permanently_set_uid(pw);
 
 	init_rng();
 	seed_rng();
Index: ssh.c
===================================================================
RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/ssh.c,v
retrieving revision 1.208
diff -u -p -r1.208 ssh.c
--- ssh.c	29 Aug 2004 06:31:28 -0000	1.208
+++ ssh.c	29 Aug 2004 07:36:10 -0000
@@ -645,7 +645,7 @@ again:
 	 * user's home directory if it happens to be on a NFS volume where
 	 * root is mapped to nobody.
 	 */
-	if (original_effective_uid == 0) {
+	if (original_effective_uid == 0 && original_real_uid != 0) {
 		PRIV_START;
 		permanently_set_uid(pw);
 	}
