diff --git a/ChangeLog b/ChangeLog
index 2505cb0e2..b44befe31 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+20040315
+ - (djm) [sshd.c] Drop supplemental groups if started as root
+
 20040311
  - (djm) [configure.ac] Add standard license to configure.ac; ok ben, dtucker
 
@@ -898,4 +901,4 @@
    - (djm) Trim deprecated options from INSTALL. Mention UsePAM
    - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
 
-$Id: ChangeLog,v 1.3288 2004/03/11 03:20:10 djm Exp $
+$Id: ChangeLog,v 1.3289 2004/03/21 22:29:57 djm Exp $
diff --git a/sshd.c b/sshd.c
index 9462bf0af..3308a8dc9 100644
--- a/sshd.c
+++ b/sshd.c
@@ -831,6 +831,9 @@ main(int ac, char **av)
 	av = saved_argv;
 #endif
 
+	if (geteuid() == 0 && setgroups(0, NULL) == -1)
+		debug("setgroups(): %.200s", strerror(errno));
+
 	/* Initialize configuration options to their default values. */
 	initialize_server_options(&options);