README.privsep revision 99060 
1Privilege separation, or privsep, is method in OpenSSH by which
2operations that require root privilege are performed by a separate
3privileged monitor process.  Its purpose is to prevent privilege
4escalation by containing corruption to an unprivileged process.  
5More information is available at:
6	http://www.citi.umich.edu/u/provos/ssh/privsep.html
7
8Privilege separation is now enabled by default; see the
9UsePrivilegeSeparation option in sshd_config(5).
10
11On systems which lack mmap or anonymous (MAP_ANON) memory mapping, 
12compression must be disabled in order for privilege separation to 
13function.
14
15When privsep is enabled, during the pre-authentication phase sshd will
16chroot(2) to "/var/empty" and change its privileges to the "sshd" user
17and its primary group.  sshd is a pseudo-account that should not be
18used by other daemons, and must be locked and should contain a
19"nologin" or invalid shell.
20
21You should do something like the following to prepare the privsep
22preauth environment:
23
24	# mkdir /var/empty
25	# chown root:sys /var/empty
26	# chmod 755 /var/empty
27	# groupadd sshd
28	# useradd -g sshd -c 'sshd privsep' -d /var/empty -s /bin/false sshd
29
30/var/empty should not contain any files.
31
32configure supports the following options to change the default
33privsep user and chroot directory:
34
35  --with-privsep-path=xxx Path for privilege separation chroot
36  --with-privsep-user=user Specify non-privileged user for privilege separation
37
38Privsep requires operating system support for file descriptor passing.
39Compression will be disabled on systems without a working mmap MAP_ANON.
40
41PAM-enabled OpenSSH is known to function with privsep on Linux.  
42It does not function on HP-UX with a trusted system
43configuration.  PAMAuthenticationViaKbdInt does not function with
44privsep.
45
46Note that for a normal interactive login with a shell, enabling privsep
47will require 1 additional process per login session.
48
49Given the following process listing (from HP-UX):
50
51     UID   PID  PPID  C    STIME TTY       TIME COMMAND
52    root  1005     1  0 10:45:17 ?         0:08 /opt/openssh/sbin/sshd -u0
53    root  6917  1005  0 15:19:16 ?         0:00 sshd: stevesk [priv]
54 stevesk  6919  6917  0 15:19:17 ?         0:03 sshd: stevesk@2
55 stevesk  6921  6919  0 15:19:17 pts/2     0:00 -bash
56
57process 1005 is the sshd process listening for new connections.
58process 6917 is the privileged monitor process, 6919 is the user owned
59sshd process and 6921 is the shell process.
60
61$Id: README.privsep,v 1.10 2002/06/26 00:43:57 stevesk Exp $
62