From 40b011c7fe2aede4e43be7049f074ab7c2347b2c Mon Sep 17 00:00:00 2001 From: Kevin Steves Date: Wed, 26 Jun 2002 00:43:57 +0000 Subject: [PATCH] - (stevesk) [README.privsep] more for sshd pseudo-account. --- ChangeLog | 3 ++- README.privsep | 12 ++++++++---- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 2b7bfd0d0..b28bb4b07 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,6 +32,7 @@ - (tim) [README.privsep] UnixWare tip no longer needed. - (bal) fixed NeXTStep missing munmap() issue. It defines HAVE_MMAP, but it all damned lies. + - (stevesk) [README.privsep] more for sshd pseudo-account. 20020625 - (stevesk) [INSTALL acconfig.h configure.ac defines.h] remove --with-rsh @@ -1131,4 +1132,4 @@ - (stevesk) entropy.c: typo in debug message - (djm) ssh-keygen -i needs seeded RNG; report from markus@ -$Id: ChangeLog,v 1.2286 2002/06/26 00:29:02 mouring Exp $ +$Id: ChangeLog,v 1.2287 2002/06/26 00:43:57 stevesk Exp $ diff --git a/README.privsep b/README.privsep index dd8069a77..ced943f26 100644 --- a/README.privsep +++ b/README.privsep @@ -14,14 +14,18 @@ function. When privsep is enabled, during the pre-authentication phase sshd will chroot(2) to "/var/empty" and change its privileges to the "sshd" user -and its primary group. You should do something like the following to -prepare the privsep preauth environment: +and its primary group. sshd is a pseudo-account that should not be +used by other daemons, and must be locked and should contain a +"nologin" or invalid shell. + +You should do something like the following to prepare the privsep +preauth environment: # mkdir /var/empty # chown root:sys /var/empty # chmod 755 /var/empty # groupadd sshd - # useradd -g sshd -c 'sshd privsep' -d /var/empty sshd + # useradd -g sshd -c 'sshd privsep' -d /var/empty -s /bin/false sshd /var/empty should not contain any files. @@ -54,4 +58,4 @@ process 1005 is the sshd process listening for new connections. process 6917 is the privileged monitor process, 6919 is the user owned sshd process and 6921 is the shell process. -$Id: README.privsep,v 1.9 2002/06/26 00:25:48 tim Exp $ +$Id: README.privsep,v 1.10 2002/06/26 00:43:57 stevesk Exp $