README.privsep revision 323134 
1Privilege separation, or privsep, is method in OpenSSH by which
2operations that require root privilege are performed by a separate
3privileged monitor process.  Its purpose is to prevent privilege
4escalation by containing corruption to an unprivileged process.
5More information is available at:
6	http://www.citi.umich.edu/u/provos/ssh/privsep.html
7
8Privilege separation is now enabled by default; see the
9UsePrivilegeSeparation option in sshd_config(5).
10
11When privsep is enabled, during the pre-authentication phase sshd will
12chroot(2) to "/var/empty" and change its privileges to the "sshd" user
13and its primary group.  sshd is a pseudo-account that should not be
14used by other daemons, and must be locked and should contain a
15"nologin" or invalid shell.
16
17You should do something like the following to prepare the privsep
18preauth environment:
19
20	# mkdir /var/empty
21	# chown root:sys /var/empty
22	# chmod 755 /var/empty
23	# groupadd sshd
24	# useradd -g sshd -c 'sshd privsep' -d /var/empty -s /bin/false sshd
25
26/var/empty should not contain any files.
27
28configure supports the following options to change the default
29privsep user and chroot directory:
30
31  --with-privsep-path=xxx Path for privilege separation chroot
32  --with-privsep-user=user Specify non-privileged user for privilege separation
33
34PAM-enabled OpenSSH is known to function with privsep on AIX, FreeBSD, 
35HP-UX (including Trusted Mode), Linux, NetBSD and Solaris.
36
37On Cygwin, Tru64 Unix, OpenServer, and Unicos only the pre-authentication
38part of privsep is supported.  Post-authentication privsep is disabled
39automatically (so you won't see the additional process mentioned below).
40
41Note that for a normal interactive login with a shell, enabling privsep
42will require 1 additional process per login session.
43
44Given the following process listing (from HP-UX):
45
46     UID   PID  PPID  C    STIME TTY       TIME COMMAND
47    root  1005     1  0 10:45:17 ?         0:08 /opt/openssh/sbin/sshd -u0
48    root  6917  1005  0 15:19:16 ?         0:00 sshd: stevesk [priv]
49 stevesk  6919  6917  0 15:19:17 ?         0:03 sshd: stevesk@2
50 stevesk  6921  6919  0 15:19:17 pts/2     0:00 -bash
51
52process 1005 is the sshd process listening for new connections.
53process 6917 is the privileged monitor process, 6919 is the user owned
54sshd process and 6921 is the shell process.
55