Re: Privsep

From: Erick Mechler (emechler@techometer.net)
Date: 12/10/02 

Date: Tue, 10 Dec 2002 11:36:59 -0800
From: Erick Mechler <emechler@techometer.net>
To: Duckbreath <duckbreath@yahoo.com>

:: So how do I get sshd to run off the sshd user?
:: Would apache be cooperative with the www user as well,
:: or is that more tricky?

Privsep is just an sshd thing right now. If you do a system upgrade via
source, the new user should get setup, and the appropriate chroot
environment will as well (/var/empty). To enable sshd privsep, set

  UsePrivilegeSeparation yes

in /etc/ssh/sshd_config. As for running Apache as the www user, set

  User www
  Group www

in your httpd.conf file. Make sure that the user and group you choose can
read all the files in your DocumentRoot, too. The parent process will
continue to run as root (binding to privileged ports and all), but the
children will run as www).

Hope this helps...

Cheers - Erick

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • RE: possible ssh hack
    ... What version of SSHD were you running, ... Apache and we can help you out. ... Subject: possible ssh hack ... port 4207 ...
    (Incidents)
  • how to close ssh connection but continue in the background?
    ... the program's parent process is always sshd. ... process to do the background processing and exiting the parent process - ... the server waits for the whole process tree to finish. ...
    (comp.os.linux.development.apps)
  • how to close ssh connection but continue in the background?
    ... the program's parent process is always sshd. ... process to do the background processing and exiting the parent process - ... the server waits for the whole process tree to finish. ...
    (comp.os.linux.development.system)
  • Re: malicious attempt on apache ?
    ... I have in the last few months put up a apache webserver on my gateway ... You could always run sshd on an alternative port, this way you get rid of the ... Depends on if they run sshd, if they don't then they don't get any such logs. ... There aren't anything you can do with the Apache, as none of those log rows ...
    (alt.os.linux)
  • Re: ISPs supporting sshd on port 443?
    ... provided you will be running ssl-enabled web services. ... apache and sshd running on port 443 will ... > I run an instance of sshd on port 443 as well on most of my servers, ...
    (freebsd-isp)