1 Privilege separation, or privsep, is method in OpenSSH by which 2 operations that require root privilege are performed by a separate 3 privileged monitor process. Its purpose is to prevent privilege 4 escalation by containing corruption to an unprivileged process. 5 More information is available at: 6 http://www.citi.umich.edu/u/provos/ssh/privsep.html 7 8 Privilege separation is now enabled by default; see the 9 UsePrivilegeSeparation option in sshd_config(5). 10 11 When privsep is enabled, during the pre-authentication phase sshd will 12 chroot(2) to "/var/empty" and change its privileges to the "sshd" user 13 and its primary group. sshd is a pseudo-account that should not be 14 used by other daemons, and must be locked and should contain a 15 "nologin" or invalid shell. 16 17 You should do something like the following to prepare the privsep 18 preauth environment: 19 20 # mkdir /var/empty 21 # chown root:sys /var/empty 22 # chmod 755 /var/empty 23 # groupadd sshd 24 # useradd -g sshd -c 'sshd privsep' -d /var/empty -s /bin/false sshd 25 26 /var/empty should not contain any files. 27 28 configure supports the following options to change the default 29 privsep user and chroot directory: 30 31 --with-privsep-path=xxx Path for privilege separation chroot 32 --with-privsep-user=user Specify non-privileged user for privilege separation 33 34 PAM-enabled OpenSSH is known to function with privsep on AIX, FreeBSD, 35 HP-UX (including Trusted Mode), Linux, NetBSD and Solaris. 36 37 On Cygwin, Tru64 Unix, OpenServer, and Unicos only the pre-authentication 38 part of privsep is supported. Post-authentication privsep is disabled 39 automatically (so you won't see the additional process mentioned below). 40 41 Note that for a normal interactive login with a shell, enabling privsep 42 will require 1 additional process per login session. 43 44 Given the following process listing (from HP-UX): 45 46 UID PID PPID C STIME TTY TIME COMMAND 47 root 1005 1 0 10:45:17 ? 0:08 /opt/openssh/sbin/sshd -u0 48 root 6917 1005 0 15:19:16 ? 0:00 sshd: stevesk [priv] 49 stevesk 6919 6917 0 15:19:17 ? 0:03 sshd: stevesk@2 50 stevesk 6921 6919 0 15:19:17 pts/2 0:00 -bash 51 52 process 1005 is the sshd process listening for new connections. 53 process 6917 is the privileged monitor process, 6919 is the user owned 54 sshd process and 6921 is the shell process. 55
