- (stevesk) --with-privsep-user; default sshd

diff --git a/ChangeLog b/ChangeLog
index 3d5d81ff176b918cb059c8557e55fd86f5e4cdad..0581652a3dd9fdcffd7dfa2bb791e937db1b44ba 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,7 @@
    monitor_mm.c
  - (stevesk) remove configure support for poll.h; it was removed
    from sshd.c a long time ago.
+ - (stevesk) --with-privsep-user; default sshd
 
 20020406
  - (djm) Typo in Suse SPEC file. Fix from Carsten Grohmann 

diff --git a/acconfig.h b/acconfig.h
index 38b78977566b8c1e3182ac7157edbe7f5ca82423..541e7886a6f5ced5c8267ecb12a67f294d557582 100644 (file)
--- a/acconfig.h
+++ b/acconfig.h
@@ -100,6 +100,9 @@
 /* Builtin PRNG command timeout */
 #undef ENTROPY_TIMEOUT_MSEC
 
+/* non-privileged user for privilege separation */
+#undef SSH_PRIVSEP_USER
+
 /* Define if you want to install preformatted manpages.*/
 #undef MANTYPE
 

diff --git a/configure.ac b/configure.ac
index ef5bf7b2ca2d3f6175d45ae278b6471b4aeb3e4e..a893d20298f57bf80d598d3c4cafb5606b5b52fa 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -993,9 +993,19 @@ AC_ARG_WITH(entropy-timeout,
                fi
        ]       
 )
-
 AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout)
 
+ssh_privsep_user=sshd
+AC_ARG_WITH(privsep-user,
+       [  --with-privsep-user     Specify non-privileged user for privilege separation],
+       [
+               if test -n "$withval"; then
+                       ssh_privsep_user=$withval
+               fi
+       ]       
+)
+AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, $ssh_privsep_user)
+
 # We do this little dance with the search path to insure
 # that programs that we select for use by installed programs
 # (which may be run by the super-user) come from trusted

diff --git a/ssh.h b/ssh.h
index c5b500345477ef1b001b98ae4181e93b29f9c764..eefd57d5ddd76802d8e48b84cf06ced57983d265 100644 (file)
--- a/ssh.h
+++ b/ssh.h
@@ -104,7 +104,9 @@
  * sshd will change its pivileges to this user and its
  * primary group.
  */
+#ifndef SSH_PRIVSEP_USER
 #define SSH_PRIVSEP_USER               "nobody"
+#endif
 
 /* Minimum modulus size (n) for RSA keys. */
 #define SSH_RSA_MINIMUM_MODULUS_SIZE   768