[CentOS] defense-in-depth possible for sshd?

Bennett Haselton bennett at peacefire.org
Tue Jan 10 13:34:00 UTC 2012


On 1/10/2012 5:16 AM, John Doe wrote:
> From: Bennett Haselton<bennett at peacefire.org>
>
>> On 1/10/2012 2:02 AM, Adrian Sevcenco wrote:
>>>   UsePrivilegeSeparation
>>>   Specifies whether sshd(8) separates privileges by creating an
>>>   unprivileged child process to deal with incoming network traffic.
>>>   After successful authentication, another process will be created that
>>>   has the privilege of the authenticated user.  The goal of privilege
>>>   separation is to prevent privilege escalation by containing any
>>>   corruption within the unprivileged processes.  The default is
>> ``yes''.
>> OK.  So it sounds like if you found a particular exploit in sshd that
>> could *only* do certain things -- like write a file to an arbitrary
>> location on disk -- then this privilege separation would prevent that
>> exploit from being used to make the child process write somewhere that
>> it didn't have privileges to write to.
> Do a ps and look at the sshd tree.  Example:
> root      6014  0.0  0.1  97816  3760 ?        S    11:01   0:00  \_ sshd: bob [priv]
> bob       6029  0.0  0.0  97816  1796 ?        S    11:01   0:00      \_ sshd: bob at pts/2
> bob       6030  0.0  0.0 108392  1760 pts/2    Ss   11:01   0:00          \_ -bash
>
> The sshd child is running as bob; so it has bob (and not root) rights...
>
> JD

Yes, I understand that.  What I said was that if you could take complete 
control of the sshd process you were connecting to, even if that process 
was completely unprivileged, you could still make it say "Accept a login 
from 'root' with password 'foo'" and then log in as root.

Bennett



More information about the CentOS mailing list