Import of OpenSSH 3.4p1

[gssapi-openssh.git] / openssh / README.privsep

diff --git a/openssh/README.privsep b/openssh/README.privsep
index c2ce935a9acb419d3639f0df873df9a0b29e5a80..b99a66792a77751aa95a9a32dbc0e6bf330feb62 100644 (file)
--- a/openssh/README.privsep
+++ b/openssh/README.privsep
@@ -12,19 +12,20 @@ On systems which lack mmap or anonymous (MAP_ANON) memory mapping,
 compression must be disabled in order for privilege separation to 
 function.
 
-When privsep is enabled, the pre-authentication sshd process will
+When privsep is enabled, during the pre-authentication phase sshd will
 chroot(2) to "/var/empty" and change its privileges to the "sshd" user
-and its primary group.  You should do something like the following to
-prepare the privsep preauth environment:
+and its primary group.  sshd is a pseudo-account that should not be
+used by other daemons, and must be locked and should contain a
+"nologin" or invalid shell.
+
+You should do something like the following to prepare the privsep
+preauth environment:
 
        # mkdir /var/empty
        # chown root:sys /var/empty
        # chmod 755 /var/empty
        # groupadd sshd
-       # useradd -g sshd sshd
-
-If you are on UnixWare 7 or OpenUNIX 8 do this additional step.
-       # ln /usr/lib/.ns.so /usr/lib/ns.so.1
+       # useradd -g sshd -c 'sshd privsep' -d /var/empty -s /bin/false sshd
 
 /var/empty should not contain any files.
 
@@ -34,8 +35,8 @@ privsep user and chroot directory:
   --with-privsep-path=xxx Path for privilege separation chroot
   --with-privsep-user=user Specify non-privileged user for privilege separation
 
-Privsep requires operating system support for file descriptor passing
-and mmap(MAP_ANON).
+Privsep requires operating system support for file descriptor passing.
+Compression will be disabled on systems without a working mmap MAP_ANON.
 
 PAM-enabled OpenSSH is known to function with privsep on Linux.  
 It does not function on HP-UX with a trusted system