summaryrefslogtreecommitdiff
path: root/README.privsep
diff options
context:
space:
mode:
authorDamien Miller <djm@mindrot.org>2003-11-21 23:48:55 +1100
committerDamien Miller <djm@mindrot.org>2003-11-21 23:48:55 +1100
commita8e06cef35c205e1aa562513c6d034a10c8c9a6d (patch)
treecf8bdb4466f553088c020b9179cabd6eaf196075 /README.privsep
parent8c5e91c03fdd2693f0635f8b2a9904bffc94ce16 (diff)
- djm@cvs.openbsd.org 2003/11/21 11:57:03
[everything] unexpand and delete whitespace at EOL; ok markus@ (done locally and RCS IDs synced)
Diffstat (limited to 'README.privsep')
-rw-r--r--README.privsep12
1 files changed, 6 insertions, 6 deletions
diff --git a/README.privsep b/README.privsep
index 64adad83b..9d48bbcf9 100644
--- a/README.privsep
+++ b/README.privsep
@@ -1,15 +1,15 @@
1Privilege separation, or privsep, is method in OpenSSH by which 1Privilege separation, or privsep, is method in OpenSSH by which
2operations that require root privilege are performed by a separate 2operations that require root privilege are performed by a separate
3privileged monitor process. Its purpose is to prevent privilege 3privileged monitor process. Its purpose is to prevent privilege
4escalation by containing corruption to an unprivileged process. 4escalation by containing corruption to an unprivileged process.
5More information is available at: 5More information is available at:
6 http://www.citi.umich.edu/u/provos/ssh/privsep.html 6 http://www.citi.umich.edu/u/provos/ssh/privsep.html
7 7
8Privilege separation is now enabled by default; see the 8Privilege separation is now enabled by default; see the
9UsePrivilegeSeparation option in sshd_config(5). 9UsePrivilegeSeparation option in sshd_config(5).
10 10
11On systems which lack mmap or anonymous (MAP_ANON) memory mapping, 11On systems which lack mmap or anonymous (MAP_ANON) memory mapping,
12compression must be disabled in order for privilege separation to 12compression must be disabled in order for privilege separation to
13function. 13function.
14 14
15When privsep is enabled, during the pre-authentication phase sshd will 15When privsep is enabled, during the pre-authentication phase sshd will
@@ -38,9 +38,9 @@ privsep user and chroot directory:
38Privsep requires operating system support for file descriptor passing. 38Privsep requires operating system support for file descriptor passing.
39Compression will be disabled on systems without a working mmap MAP_ANON. 39Compression will be disabled on systems without a working mmap MAP_ANON.
40 40
41PAM-enabled OpenSSH is known to function with privsep on Linux. 41PAM-enabled OpenSSH is known to function with privsep on Linux.
42It does not function on HP-UX with a trusted system 42It does not function on HP-UX with a trusted system
43configuration. 43configuration.
44 44
45On Compaq Tru64 Unix, only the pre-authentication part of privsep is 45On Compaq Tru64 Unix, only the pre-authentication part of privsep is
46supported. Post-authentication privsep is disabled automatically (so 46supported. Post-authentication privsep is disabled automatically (so
@@ -61,4 +61,4 @@ process 1005 is the sshd process listening for new connections.
61process 6917 is the privileged monitor process, 6919 is the user owned 61process 6917 is the privileged monitor process, 6919 is the user owned
62sshd process and 6921 is the shell process. 62sshd process and 6921 is the shell process.
63 63
64$Id: README.privsep,v 1.12 2003/08/26 00:48:15 djm Exp $ 64$Id: README.privsep,v 1.13 2003/11/21 12:48:55 djm Exp $