1Privilege separation, or privsep, is method in OpenSSH by which 2operations that require root privilege are performed by a separate 3privileged monitor process. Its purpose is to prevent privilege 4escalation by containing corruption to an unprivileged process. 5More information is available at: 6 http://www.citi.umich.edu/u/provos/ssh/privsep.html 7 8Privilege separation is now enabled by default; see the 9UsePrivilegeSeparation option in sshd_config(5). 10 11On systems which lack mmap or anonymous (MAP_ANON) memory mapping, 12compression must be disabled in order for privilege separation to 13function. 14 15When privsep is enabled, the pre-authentication sshd process will 16chroot(2) to "/var/empty" and change its privileges to the "sshd" user 17and its primary group. You should do something like the following to 18prepare the privsep preauth environment: 19 20 # mkdir /var/empty 21 # chown root:sys /var/empty 22 # chmod 755 /var/empty 23 # groupadd sshd 24 # useradd -g sshd sshd 25 26If you are on UnixWare 7 or OpenUNIX 8 do this additional step. 27 # ln /usr/lib/.ns.so /usr/lib/ns.so.1 28 29/var/empty should not contain any files. 30 31configure supports the following options to change the default 32privsep user and chroot directory: 33 34 --with-privsep-path=xxx Path for privilege separation chroot 35 --with-privsep-user=user Specify non-privileged user for privilege separation 36 37Privsep requires operating system support for file descriptor passing 38and mmap(MAP_ANON). 39 40PAM-enabled OpenSSH is known to function with privsep on Linux. 41It does not function on HP-UX with a trusted system 42configuration. PAMAuthenticationViaKbdInt does not function with 43privsep. 44 45Note that for a normal interactive login with a shell, enabling privsep 46will require 1 additional process per login session. 47 48Given the following process listing (from HP-UX): 49 50 UID PID PPID C STIME TTY TIME COMMAND 51 root 1005 1 0 10:45:17 ? 0:08 /opt/openssh/sbin/sshd -u0 52 root 6917 1005 0 15:19:16 ? 0:00 sshd: stevesk [priv] 53 stevesk 6919 6917 0 15:19:17 ? 0:03 sshd: stevesk@2 54 stevesk 6921 6919 0 15:19:17 pts/2 0:00 -bash 55 56process 1005 is the sshd process listening for new connections. 57process 6917 is the privileged monitor process, 6919 is the user owned 58sshd process and 6921 is the shell process. 59 60$Id: README.privsep,v 1.7 2002/06/21 14:48:02 djm Exp $ 61