1 Privilege separation, or privsep, is method in OpenSSH by which
2 operations that require root privilege are performed by a separate
3 privileged monitor process. Its purpose is to prevent privilege
4 escalation by containing corruption to an unprivileged process.
5 More information is available at:
6 http://www.citi.umich.edu/u/provos/ssh/privsep.html
8 Privilege separation is now enabled by default; see the
9 UsePrivilegeSeparation option in sshd_config(5).
11 On systems which lack mmap or anonymous (MAP_ANON) memory mapping,
12 compression must be disabled in order for privilege separation to
15 When privsep is enabled, the pre-authentication sshd process will
16 chroot(2) to "/var/empty" and change its privileges to the "sshd" user
17 and its primary group. You should do something like the following to
18 prepare the privsep preauth environment:
21 # chown root:sys /var/empty
22 # chmod 755 /var/empty
24 # useradd -g sshd sshd
26 If you are on UnixWare 7 or OpenUNIX 8 do this additional step.
27 # ln /usr/lib/.ns.so /usr/lib/ns.so.1
29 /var/empty should not contain any files.
31 configure supports the following options to change the default
32 privsep user and chroot directory:
34 --with-privsep-path=xxx Path for privilege separation chroot
35 --with-privsep-user=user Specify non-privileged user for privilege separation
37 Privsep requires operating system support for file descriptor passing
40 PAM-enabled OpenSSH is known to function with privsep on Linux.
41 It does not function on HP-UX with a trusted system
42 configuration. PAMAuthenticationViaKbdInt does not function with
45 Note that for a normal interactive login with a shell, enabling privsep
46 will require 1 additional process per login session.
48 Given the following process listing (from HP-UX):
50 UID PID PPID C STIME TTY TIME COMMAND
51 root 1005 1 0 10:45:17 ? 0:08 /opt/openssh/sbin/sshd -u0
52 root 6917 1005 0 15:19:16 ? 0:00 sshd: stevesk [priv]
53 stevesk 6919 6917 0 15:19:17 ? 0:03 sshd: stevesk@2
54 stevesk 6921 6919 0 15:19:17 pts/2 0:00 -bash
56 process 1005 is the sshd process listening for new connections.
57 process 6917 is the privileged monitor process, 6919 is the user owned
58 sshd process and 6921 is the shell process.