blob: 89b9d04572400f53e5f6ba422c2c784d396b1ca4 [file] [log] [blame]
Kevin Steves02281552002-05-13 03:57:04 +00001Privilege separation, or privsep, is an experimental feature in
2OpenSSH in which operations that require root privilege are performed
3by a separate privileged monitor process. Its purpose is to prevent
4privilege escalation by containing corruption to an unprivileged
5process. More information is available at:
6 http://www.citi.umich.edu/u/provos/ssh/privsep.html
7
8Privilege separation is not enabled by default, and may be enabled by
9specifying "UsePrivilegeSeparation yes" in sshd_config; see the
10UsePrivilegeSeparation option in sshd(8).
11
12When privsep is enabled, the pre-authentication sshd process will
13chroot(2) to "/var/empty" and change its privileges to the "sshd" user
14and its primary group. You should do something like the following to
15prepare the privsep preauth environment:
16
17 # mkdir /var/empty
18 # chown root:sys /var/empty
19 # chmod 755 /var/empty
20 # groupadd sshd
21 # useradd -g sshd sshd
22
Tim Rice1e28c9e2002-05-13 17:07:18 -070023If you are on UnixWare 7 or OpenUNIX 8 do this additional step.
24 # ln /usr/lib/.ns.so /usr/lib/ns.so.1
25
Kevin Steves02281552002-05-13 03:57:04 +000026/var/empty should not contain any files.
27
28configure supports the following options to change the default
29privsep user and chroot directory:
30
Damien Miller74cc5bb2002-05-22 11:02:15 +100031 --with-privsep-path=xxx Path for privilege separation chroot
Kevin Steves02281552002-05-13 03:57:04 +000032 --with-privsep-user=user Specify non-privileged user for privilege separation
33
34Privsep requires operating system support for file descriptor passing
35and mmap(MAP_ANON).
36
Kevin Stevesf8defa22002-05-13 23:31:09 +000037PAM-enabled OpenSSH is known to function with privsep on Linux and
38Solaris 8. It does not function on HP-UX with a trusted system
39configuration. PAMAuthenticationViaKbdInt does not function with
Kevin Steves02281552002-05-13 03:57:04 +000040privsep.
41
42Note that for a normal interactive login with a shell, enabling privsep
43will require 1 additional process per login session.
44
45Given the following process listing (from HP-UX):
46
47 UID PID PPID C STIME TTY TIME COMMAND
48 root 1005 1 0 10:45:17 ? 0:08 /opt/openssh/sbin/sshd -u0
49 root 6917 1005 0 15:19:16 ? 0:00 sshd: stevesk [priv]
50 stevesk 6919 6917 0 15:19:17 ? 0:03 sshd: stevesk@2
51 stevesk 6921 6919 0 15:19:17 pts/2 0:00 -bash
52
53process 1005 is the sshd process listening for new connections.
54process 6917 is the privileged monitor process, 6919 is the user owned
55sshd process and 6921 is the shell process.
56
Damien Miller74cc5bb2002-05-22 11:02:15 +100057$Id: README.privsep,v 1.5 2002/05/22 01:02:15 djm Exp $