blob: dd8069a776e7d368a225996d7f407e189be2e578 [file] [log] [blame]
Damien Miller263d68f2002-06-22 00:45:50 +10001Privilege separation, or privsep, is method in OpenSSH by which
2operations that require root privilege are performed by a separate
3privileged monitor process. Its purpose is to prevent privilege
4escalation by containing corruption to an unprivileged process.
5More information is available at:
Kevin Steves02281552002-05-13 03:57:04 +00006 http://www.citi.umich.edu/u/provos/ssh/privsep.html
7
Damien Miller263d68f2002-06-22 00:45:50 +10008Privilege separation is now enabled by default; see the
9UsePrivilegeSeparation option in sshd_config(5).
Kevin Steves02281552002-05-13 03:57:04 +000010
Damien Miller828b1962002-06-22 00:48:02 +100011On systems which lack mmap or anonymous (MAP_ANON) memory mapping,
12compression must be disabled in order for privilege separation to
13function.
14
Kevin Stevesd4866362002-06-24 16:49:22 +000015When privsep is enabled, during the pre-authentication phase sshd will
Kevin Steves02281552002-05-13 03:57:04 +000016chroot(2) to "/var/empty" and change its privileges to the "sshd" user
17and its primary group. You should do something like the following to
18prepare the privsep preauth environment:
19
20 # mkdir /var/empty
21 # chown root:sys /var/empty
22 # chmod 755 /var/empty
23 # groupadd sshd
Kevin Stevesd4866362002-06-24 16:49:22 +000024 # useradd -g sshd -c 'sshd privsep' -d /var/empty sshd
Kevin Steves02281552002-05-13 03:57:04 +000025
26/var/empty should not contain any files.
27
28configure supports the following options to change the default
29privsep user and chroot directory:
30
Damien Miller74cc5bb2002-05-22 11:02:15 +100031 --with-privsep-path=xxx Path for privilege separation chroot
Kevin Steves02281552002-05-13 03:57:04 +000032 --with-privsep-user=user Specify non-privileged user for privilege separation
33
Tim Ricee04ee922002-06-25 17:25:47 -070034Privsep requires operating system support for file descriptor passing.
35Compression will be disabled on systems without a working mmap MAP_ANON.
Kevin Steves02281552002-05-13 03:57:04 +000036
Damien Miller263d68f2002-06-22 00:45:50 +100037PAM-enabled OpenSSH is known to function with privsep on Linux.
38It does not function on HP-UX with a trusted system
Kevin Stevesf8defa22002-05-13 23:31:09 +000039configuration. PAMAuthenticationViaKbdInt does not function with
Kevin Steves02281552002-05-13 03:57:04 +000040privsep.
41
42Note that for a normal interactive login with a shell, enabling privsep
43will require 1 additional process per login session.
44
45Given the following process listing (from HP-UX):
46
47 UID PID PPID C STIME TTY TIME COMMAND
48 root 1005 1 0 10:45:17 ? 0:08 /opt/openssh/sbin/sshd -u0
49 root 6917 1005 0 15:19:16 ? 0:00 sshd: stevesk [priv]
50 stevesk 6919 6917 0 15:19:17 ? 0:03 sshd: stevesk@2
51 stevesk 6921 6919 0 15:19:17 pts/2 0:00 -bash
52
53process 1005 is the sshd process listening for new connections.
54process 6917 is the privileged monitor process, 6919 is the user owned
55sshd process and 6921 is the shell process.
56
Tim Ricee04ee922002-06-25 17:25:47 -070057$Id: README.privsep,v 1.9 2002/06/26 00:25:48 tim Exp $