I may like to clarify to Binand Sir that
sshd will run as a root owned process but doing
creating a chroot jail can help making a pseudo "/"
directly for sshd in which it can run safely without
any permission or PAM problems, and also not running
as a real root will save from future hacks...
As per the Port business, i have just suggest to
redirect the port traffic of sshd which may be running
at a system privelege port(< 1024) to some port higher
than 1024 either through PAT or REDIRECT option in
ipchains in the firewall script... this will help in
the hacker not able to exploit trust relationship with
system privelege ports (<1024) which they do. services
running at ports < 1024 inherently trust the client
machine(in this case a hacker mc.) running root and
can lead to a successful attack....
with regards..... please correct me if i am wrong..
from Prashant.
--- Philip S Tellis <[EMAIL PROTECTED]>
wrote: > On Fri, 5 Jul 2002, Binand Raj S. wrote:
>
> > b) If you are saying that by running sshd on a
> port > 1024, then you
> > can run it as non-root, you are wrong. sshd
> requires root privileges
> > for lots of other things - access to the host
> keys, authentication via
> > various PAM modules, setting the UID/GID to the
> user authenticated,
> > logging via authpriv facility are just some of
> them.
>
> Maybe he wants each user to run their own sshd on
> some port > 1024.
> That takes care of setting the uid/gid
>
> Then you can identify the user based on which port
> he connects to.
> That takes care of authentication
>
> And of course, the port number would be a secret,
> because you wont tell
> anyone what it is.
> That takes care of security.
>
> :>
>
>
>
> --
> FORTUNE'S FUN FACTS TO KNOW AND TELL: #44
> Zebras are colored with dark stripes on a light
> background.
>
>
>
>
-------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Bringing you mounds of caffeinated joy.
> http://thinkgeek.com/sf
> _______________________________________________
> linux-india-help mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/linux-india-help
__________________________________________________
Do You Yahoo!?
Sign up for SBC Yahoo! Dial - First Month Free
http://sbc.yahoo.com
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Bringing you mounds of caffeinated joy.
http://thinkgeek.com/sf
_______________________________________________
linux-india-help mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/linux-india-help
