On 05/07/02 19:16 +0100, prashant singh wrote:
> I may like to clarify to Binand Sir that 
>  sshd will run as a root owned process but doing
> creating a chroot jail can help making a pseudo "/" 
> directly for sshd in which it can run safely without 
> any permission or PAM problems, and also not running
> as a real root will save from future hacks...
Actually, running a vulnerable process will always leave you vulnerable
to being attacked.
The correct solution is to upgrade, and use the new PrivSeparation
feature of OpenSSH.

>  As per the  Port business, i have just suggest to
> redirect the port traffic of sshd which may be running
> at a system privelege port(< 1024) to some port higher
> than 1024 either through PAT or REDIRECT option in
> ipchains in the firewall script... this will help in
> the hacker not able to exploit trust relationship with
> system privelege ports (<1024) which they do. services
> running at ports < 1024 inherently trust the client
> machine(in this case a hacker mc.) running root and
> can lead to a successful attack....
No. The *cracker* will be exploiting the fact that the sshd process runs
as root. The attack in case of a chroot jail, will still give the
cracker root access in the jail, and under some circumstances, jails can
be broken. It is not the port number that matters,but the fact that the
process is running as root that does. A shell running on port 31337 as
root is still just as bad as a shell running on 514/tcp.
The 1024 port restriction was useful in the days when administrators
could fundamentally be trusted, and you could guarantee that a process
running on a port < 1024 was authentic and not started by some mailcious
user. It was a social means of ensuring a certain degree of security in
the client ( a trust relationship), which assumption is not valid today.

Devdas Bhagat


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Got root? We do.
http://thinkgeek.com/sf
_______________________________________________
linux-india-help mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/linux-india-help

Reply via email to