Do you have a question? Post it now! No Registration Necessary. Now with pictures!
- Posted on
- Philip Le Riche
September 23, 2004, 1:35 pm
rate this thread
Is there a simple way to positively demonstrate that privilege
separation is working? Running ps -fe shows all sshd processes running
as root. If /var/empty doesn't exist, sshd still seems to work, but
presumably without privilege separation. There may be other
configuration errors which could have the same effect.
(The reason I ask is that a vulnerability assessment has shown that I
need to upgrade to OpenSSH 3.7.1 to avoid known vulnerabilities.
However, rebuilding from source has run into problems with
incompatible libraries since we're on an old version of AIX. No doubt
these are fixable, given time my management may not allow me, but if I
could positively demonstrate that privilege separation is working, I
could argue that the risk is low and limited to DoS. Agreed?)
Re: How to verify Privilege Separation is working?
Yes, "ps" will show 2 sshd's per user, one with a uid of root and
the other of the logged-in user. If the platform has setproctitle or
equivalent (I can't remember if AIX does) then the processes will have
root 17663 707 1 10:50 ? 00:00:00 sshd: dtucker [priv]
dtucker 17665 17663 1 10:50 ? 00:00:00 sshd: dtucker@pts/0
How old an AIX and what error? I built 3.8p1 on AIX 4.2.1 and I suspect
the newer OpenSSHs should be easy to get working if they don't already.
(My disk with 4.2.1 on it is dying with a bad bearing, but if it will
help I can see if it still spins :-)
What version do you have? If I were paranoid I would upgrade anyway.
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
- » OpenSSH for Win: switch.exe failed to init properly
- — Previous thread in » Secure Shell Forum
- » ssh on command line: force using a group size (prime size) of 1024 (and no...
- — Newest thread in » Secure Shell Forum