diff options
author | des <des@FreeBSD.org> | 2008-07-22 18:58:19 +0000 |
---|---|---|
committer | des <des@FreeBSD.org> | 2008-07-22 18:58:19 +0000 |
commit | 666aa9cc1660793c97ef29a6cb66dfbb894dde8f (patch) | |
tree | 209e642fbe2a816041f67bc27c9800879f5541bc /crypto/openssh/README.privsep | |
parent | 624d93001f28e236c027516d88282351eb7bffbe (diff) | |
download | FreeBSD-src-666aa9cc1660793c97ef29a6cb66dfbb894dde8f.zip FreeBSD-src-666aa9cc1660793c97ef29a6cb66dfbb894dde8f.tar.gz |
Revert part of 180714 - the intent was to flatten dist, not to nuke it.
Diffstat (limited to 'crypto/openssh/README.privsep')
-rw-r--r-- | crypto/openssh/README.privsep | 63 |
1 files changed, 63 insertions, 0 deletions
diff --git a/crypto/openssh/README.privsep b/crypto/openssh/README.privsep new file mode 100644 index 0000000..f565e72 --- /dev/null +++ b/crypto/openssh/README.privsep @@ -0,0 +1,63 @@ +Privilege separation, or privsep, is method in OpenSSH by which +operations that require root privilege are performed by a separate +privileged monitor process. Its purpose is to prevent privilege +escalation by containing corruption to an unprivileged process. +More information is available at: + http://www.citi.umich.edu/u/provos/ssh/privsep.html + +Privilege separation is now enabled by default; see the +UsePrivilegeSeparation option in sshd_config(5). + +On systems which lack mmap or anonymous (MAP_ANON) memory mapping, +compression must be disabled in order for privilege separation to +function. + +When privsep is enabled, during the pre-authentication phase sshd will +chroot(2) to "/var/empty" and change its privileges to the "sshd" user +and its primary group. sshd is a pseudo-account that should not be +used by other daemons, and must be locked and should contain a +"nologin" or invalid shell. + +You should do something like the following to prepare the privsep +preauth environment: + + # mkdir /var/empty + # chown root:sys /var/empty + # chmod 755 /var/empty + # groupadd sshd + # useradd -g sshd -c 'sshd privsep' -d /var/empty -s /bin/false sshd + +/var/empty should not contain any files. + +configure supports the following options to change the default +privsep user and chroot directory: + + --with-privsep-path=xxx Path for privilege separation chroot + --with-privsep-user=user Specify non-privileged user for privilege separation + +Privsep requires operating system support for file descriptor passing. +Compression will be disabled on systems without a working mmap MAP_ANON. + +PAM-enabled OpenSSH is known to function with privsep on AIX, FreeBSD, +HP-UX (including Trusted Mode), Linux, NetBSD and Solaris. + +On Cygwin, Tru64 Unix, OpenServer, and Unicos only the pre-authentication +part of privsep is supported. Post-authentication privsep is disabled +automatically (so you won't see the additional process mentioned below). + +Note that for a normal interactive login with a shell, enabling privsep +will require 1 additional process per login session. + +Given the following process listing (from HP-UX): + + UID PID PPID C STIME TTY TIME COMMAND + root 1005 1 0 10:45:17 ? 0:08 /opt/openssh/sbin/sshd -u0 + root 6917 1005 0 15:19:16 ? 0:00 sshd: stevesk [priv] + stevesk 6919 6917 0 15:19:17 ? 0:03 sshd: stevesk@2 + stevesk 6921 6919 0 15:19:17 pts/2 0:00 -bash + +process 1005 is the sshd process listening for new connections. +process 6917 is the privileged monitor process, 6919 is the user owned +sshd process and 6921 is the shell process. + +$Id: README.privsep,v 1.16 2005/06/04 23:21:41 djm Exp $ |