blob: 9d48bbcf970a89ca414c83e288de94cafafc9588 [file] [log] [blame]
Damien Miller263d68f2002-06-22 00:45:50 +10001Privilege separation, or privsep, is method in OpenSSH by which
2operations that require root privilege are performed by a separate
3privileged monitor process. Its purpose is to prevent privilege
Damien Millera8e06ce2003-11-21 23:48:55 +11004escalation by containing corruption to an unprivileged process.
Damien Miller263d68f2002-06-22 00:45:50 +10005More information is available at:
Kevin Steves02281552002-05-13 03:57:04 +00006 http://www.citi.umich.edu/u/provos/ssh/privsep.html
7
Damien Miller263d68f2002-06-22 00:45:50 +10008Privilege separation is now enabled by default; see the
9UsePrivilegeSeparation option in sshd_config(5).
Kevin Steves02281552002-05-13 03:57:04 +000010
Damien Millera8e06ce2003-11-21 23:48:55 +110011On systems which lack mmap or anonymous (MAP_ANON) memory mapping,
12compression must be disabled in order for privilege separation to
Damien Miller828b1962002-06-22 00:48:02 +100013function.
14
Kevin Stevesd4866362002-06-24 16:49:22 +000015When privsep is enabled, during the pre-authentication phase sshd will
Kevin Steves02281552002-05-13 03:57:04 +000016chroot(2) to "/var/empty" and change its privileges to the "sshd" user
Kevin Steves40b011c2002-06-26 00:43:57 +000017and its primary group. sshd is a pseudo-account that should not be
18used by other daemons, and must be locked and should contain a
19"nologin" or invalid shell.
20
21You should do something like the following to prepare the privsep
22preauth environment:
Kevin Steves02281552002-05-13 03:57:04 +000023
24 # mkdir /var/empty
25 # chown root:sys /var/empty
26 # chmod 755 /var/empty
27 # groupadd sshd
Kevin Steves40b011c2002-06-26 00:43:57 +000028 # useradd -g sshd -c 'sshd privsep' -d /var/empty -s /bin/false sshd
Kevin Steves02281552002-05-13 03:57:04 +000029
30/var/empty should not contain any files.
31
32configure supports the following options to change the default
33privsep user and chroot directory:
34
Damien Miller74cc5bb2002-05-22 11:02:15 +100035 --with-privsep-path=xxx Path for privilege separation chroot
Kevin Steves02281552002-05-13 03:57:04 +000036 --with-privsep-user=user Specify non-privileged user for privilege separation
37
Tim Ricee04ee922002-06-25 17:25:47 -070038Privsep requires operating system support for file descriptor passing.
39Compression will be disabled on systems without a working mmap MAP_ANON.
Kevin Steves02281552002-05-13 03:57:04 +000040
Damien Millera8e06ce2003-11-21 23:48:55 +110041PAM-enabled OpenSSH is known to function with privsep on Linux.
Damien Miller263d68f2002-06-22 00:45:50 +100042It does not function on HP-UX with a trusted system
Damien Millera8e06ce2003-11-21 23:48:55 +110043configuration.
Kevin Steves02281552002-05-13 03:57:04 +000044
Ben Lindstromc8c548d2003-03-21 01:18:09 +000045On Compaq Tru64 Unix, only the pre-authentication part of privsep is
46supported. Post-authentication privsep is disabled automatically (so
47you won't see the additional process mentioned below).
48
Kevin Steves02281552002-05-13 03:57:04 +000049Note that for a normal interactive login with a shell, enabling privsep
50will require 1 additional process per login session.
51
52Given the following process listing (from HP-UX):
53
54 UID PID PPID C STIME TTY TIME COMMAND
55 root 1005 1 0 10:45:17 ? 0:08 /opt/openssh/sbin/sshd -u0
56 root 6917 1005 0 15:19:16 ? 0:00 sshd: stevesk [priv]
57 stevesk 6919 6917 0 15:19:17 ? 0:03 sshd: stevesk@2
58 stevesk 6921 6919 0 15:19:17 pts/2 0:00 -bash
59
60process 1005 is the sshd process listening for new connections.
61process 6917 is the privileged monitor process, 6919 is the user owned
62sshd process and 6921 is the shell process.
63
Damien Millera8e06ce2003-11-21 23:48:55 +110064$Id: README.privsep,v 1.13 2003/11/21 12:48:55 djm Exp $