diff options
Diffstat (limited to 'README.privsep')
-rw-r--r-- | README.privsep | 53 |
1 files changed, 53 insertions, 0 deletions
diff --git a/README.privsep b/README.privsep new file mode 100644 index 000000000..4f15cf433 --- /dev/null +++ b/README.privsep | |||
@@ -0,0 +1,53 @@ | |||
1 | Privilege separation, or privsep, is an experimental feature in | ||
2 | OpenSSH in which operations that require root privilege are performed | ||
3 | by a separate privileged monitor process. Its purpose is to prevent | ||
4 | privilege escalation by containing corruption to an unprivileged | ||
5 | process. More information is available at: | ||
6 | http://www.citi.umich.edu/u/provos/ssh/privsep.html | ||
7 | |||
8 | Privilege separation is not enabled by default, and may be enabled by | ||
9 | specifying "UsePrivilegeSeparation yes" in sshd_config; see the | ||
10 | UsePrivilegeSeparation option in sshd(8). | ||
11 | |||
12 | When privsep is enabled, the pre-authentication sshd process will | ||
13 | chroot(2) to "/var/empty" and change its privileges to the "sshd" user | ||
14 | and its primary group. You should do something like the following to | ||
15 | prepare the privsep preauth environment: | ||
16 | |||
17 | # mkdir /var/empty | ||
18 | # chown root:sys /var/empty | ||
19 | # chmod 755 /var/empty | ||
20 | # groupadd sshd | ||
21 | # useradd -g sshd sshd | ||
22 | |||
23 | /var/empty should not contain any files. | ||
24 | |||
25 | configure supports the following options to change the default | ||
26 | privsep user and chroot directory: | ||
27 | |||
28 | --with-privsep-path=xxx Path for privilege seperation chroot | ||
29 | --with-privsep-user=user Specify non-privileged user for privilege separation | ||
30 | |||
31 | Privsep requires operating system support for file descriptor passing | ||
32 | and mmap(MAP_ANON). | ||
33 | |||
34 | PAM currently only works with privsep on Linux. It does not function | ||
35 | on Solaris or HP-UX. PAMAuthenticationViaKbdInt does not function with | ||
36 | privsep. | ||
37 | |||
38 | Note that for a normal interactive login with a shell, enabling privsep | ||
39 | will require 1 additional process per login session. | ||
40 | |||
41 | Given the following process listing (from HP-UX): | ||
42 | |||
43 | UID PID PPID C STIME TTY TIME COMMAND | ||
44 | root 1005 1 0 10:45:17 ? 0:08 /opt/openssh/sbin/sshd -u0 | ||
45 | root 6917 1005 0 15:19:16 ? 0:00 sshd: stevesk [priv] | ||
46 | stevesk 6919 6917 0 15:19:17 ? 0:03 sshd: stevesk@2 | ||
47 | stevesk 6921 6919 0 15:19:17 pts/2 0:00 -bash | ||
48 | |||
49 | process 1005 is the sshd process listening for new connections. | ||
50 | process 6917 is the privileged monitor process, 6919 is the user owned | ||
51 | sshd process and 6921 is the shell process. | ||
52 | |||
53 | $Id: README.privsep,v 1.1 2002/05/13 03:57:04 stevesk Exp $ | ||