- (dtucker) [openbsd-compat/openssl-compat.c] Bug #1707: Call OPENSSL_config()

[openssh.git] / README.privsep

diff --git a/README.privsep b/README.privsep
index 581bbefc414767b3cf77d9a38c2c57840fb96fae..b8c633b7a090fd09987c0fd388685027490d2ffc 100644 (file)
--- a/README.privsep
+++ b/README.privsep
@@ -1,15 +1,15 @@
 Privilege separation, or privsep, is method in OpenSSH by which
 operations that require root privilege are performed by a separate
 privileged monitor process.  Its purpose is to prevent privilege
-escalation by containing corruption to an unprivileged process.  
+escalation by containing corruption to an unprivileged process.
 More information is available at:
        http://www.citi.umich.edu/u/provos/ssh/privsep.html
 
 Privilege separation is now enabled by default; see the
 UsePrivilegeSeparation option in sshd_config(5).
 
-On systems which lack mmap or anonymous (MAP_ANON) memory mapping, 
-compression must be disabled in order for privilege separation to 
+On systems which lack mmap or anonymous (MAP_ANON) memory mapping,
+compression must be disabled in order for privilege separation to
 function.
 
 When privsep is enabled, during the pre-authentication phase sshd will
@@ -38,14 +38,12 @@ privsep user and chroot directory:
 Privsep requires operating system support for file descriptor passing.
 Compression will be disabled on systems without a working mmap MAP_ANON.
 
-PAM-enabled OpenSSH is known to function with privsep on Linux.  
-It does not function on HP-UX with a trusted system
-configuration.  PAMAuthenticationViaKbdInt does not function with
-privsep.
+PAM-enabled OpenSSH is known to function with privsep on AIX, FreeBSD, 
+HP-UX (including Trusted Mode), Linux, NetBSD and Solaris.
 
-On Compaq Tru64 Unix, only the pre-authentication part of privsep is
-supported.  Post-authentication privsep is disabled automatically (so
-you won't see the additional process mentioned below).
+On Cygwin, Tru64 Unix, OpenServer, and Unicos only the pre-authentication
+part of privsep is supported.  Post-authentication privsep is disabled
+automatically (so you won't see the additional process mentioned below).
 
 Note that for a normal interactive login with a shell, enabling privsep
 will require 1 additional process per login session.