Damien Miller | 263d68f | 2002-06-22 00:45:50 +1000 | [diff] [blame] | 1 | Privilege separation, or privsep, is method in OpenSSH by which |
| 2 | operations that require root privilege are performed by a separate |
| 3 | privileged monitor process. Its purpose is to prevent privilege |
| 4 | escalation by containing corruption to an unprivileged process. |
| 5 | More information is available at: |
Kevin Steves | 0228155 | 2002-05-13 03:57:04 +0000 | [diff] [blame] | 6 | http://www.citi.umich.edu/u/provos/ssh/privsep.html |
| 7 | |
Damien Miller | 263d68f | 2002-06-22 00:45:50 +1000 | [diff] [blame] | 8 | Privilege separation is now enabled by default; see the |
| 9 | UsePrivilegeSeparation option in sshd_config(5). |
Kevin Steves | 0228155 | 2002-05-13 03:57:04 +0000 | [diff] [blame] | 10 | |
Damien Miller | 828b196 | 2002-06-22 00:48:02 +1000 | [diff] [blame] | 11 | On systems which lack mmap or anonymous (MAP_ANON) memory mapping, |
| 12 | compression must be disabled in order for privilege separation to |
| 13 | function. |
| 14 | |
Kevin Steves | d486636 | 2002-06-24 16:49:22 +0000 | [diff] [blame] | 15 | When privsep is enabled, during the pre-authentication phase sshd will |
Kevin Steves | 0228155 | 2002-05-13 03:57:04 +0000 | [diff] [blame] | 16 | chroot(2) to "/var/empty" and change its privileges to the "sshd" user |
| 17 | and its primary group. You should do something like the following to |
| 18 | prepare the privsep preauth environment: |
| 19 | |
| 20 | # mkdir /var/empty |
| 21 | # chown root:sys /var/empty |
| 22 | # chmod 755 /var/empty |
| 23 | # groupadd sshd |
Kevin Steves | d486636 | 2002-06-24 16:49:22 +0000 | [diff] [blame] | 24 | # useradd -g sshd -c 'sshd privsep' -d /var/empty sshd |
Kevin Steves | 0228155 | 2002-05-13 03:57:04 +0000 | [diff] [blame] | 25 | |
Tim Rice | 1e28c9e | 2002-05-13 17:07:18 -0700 | [diff] [blame] | 26 | If you are on UnixWare 7 or OpenUNIX 8 do this additional step. |
| 27 | # ln /usr/lib/.ns.so /usr/lib/ns.so.1 |
| 28 | |
Kevin Steves | 0228155 | 2002-05-13 03:57:04 +0000 | [diff] [blame] | 29 | /var/empty should not contain any files. |
| 30 | |
| 31 | configure supports the following options to change the default |
| 32 | privsep user and chroot directory: |
| 33 | |
Damien Miller | 74cc5bb | 2002-05-22 11:02:15 +1000 | [diff] [blame] | 34 | --with-privsep-path=xxx Path for privilege separation chroot |
Kevin Steves | 0228155 | 2002-05-13 03:57:04 +0000 | [diff] [blame] | 35 | --with-privsep-user=user Specify non-privileged user for privilege separation |
| 36 | |
| 37 | Privsep requires operating system support for file descriptor passing |
| 38 | and mmap(MAP_ANON). |
| 39 | |
Damien Miller | 263d68f | 2002-06-22 00:45:50 +1000 | [diff] [blame] | 40 | PAM-enabled OpenSSH is known to function with privsep on Linux. |
| 41 | It does not function on HP-UX with a trusted system |
Kevin Steves | f8defa2 | 2002-05-13 23:31:09 +0000 | [diff] [blame] | 42 | configuration. PAMAuthenticationViaKbdInt does not function with |
Kevin Steves | 0228155 | 2002-05-13 03:57:04 +0000 | [diff] [blame] | 43 | privsep. |
| 44 | |
| 45 | Note that for a normal interactive login with a shell, enabling privsep |
| 46 | will require 1 additional process per login session. |
| 47 | |
| 48 | Given the following process listing (from HP-UX): |
| 49 | |
| 50 | UID PID PPID C STIME TTY TIME COMMAND |
| 51 | root 1005 1 0 10:45:17 ? 0:08 /opt/openssh/sbin/sshd -u0 |
| 52 | root 6917 1005 0 15:19:16 ? 0:00 sshd: stevesk [priv] |
| 53 | stevesk 6919 6917 0 15:19:17 ? 0:03 sshd: stevesk@2 |
| 54 | stevesk 6921 6919 0 15:19:17 pts/2 0:00 -bash |
| 55 | |
| 56 | process 1005 is the sshd process listening for new connections. |
| 57 | process 6917 is the privileged monitor process, 6919 is the user owned |
| 58 | sshd process and 6921 is the shell process. |
| 59 | |
Kevin Steves | d486636 | 2002-06-24 16:49:22 +0000 | [diff] [blame] | 60 | $Id: README.privsep,v 1.8 2002/06/24 16:49:22 stevesk Exp $ |