On 05/07/02 19:16 +0100, prashant singh wrote: > I may like to clarify to Binand Sir that > sshd will run as a root owned process but doing > creating a chroot jail can help making a pseudo "/" > directly for sshd in which it can run safely without > any permission or PAM problems, and also not running > as a real root will save from future hacks... Actually, running a vulnerable process will always leave you vulnerable to being attacked. The correct solution is to upgrade, and use the new PrivSeparation feature of OpenSSH.
> As per the Port business, i have just suggest to > redirect the port traffic of sshd which may be running > at a system privelege port(< 1024) to some port higher > than 1024 either through PAT or REDIRECT option in > ipchains in the firewall script... this will help in > the hacker not able to exploit trust relationship with > system privelege ports (<1024) which they do. services > running at ports < 1024 inherently trust the client > machine(in this case a hacker mc.) running root and > can lead to a successful attack.... No. The *cracker* will be exploiting the fact that the sshd process runs as root. The attack in case of a chroot jail, will still give the cracker root access in the jail, and under some circumstances, jails can be broken. It is not the port number that matters,but the fact that the process is running as root that does. A shell running on port 31337 as root is still just as bad as a shell running on 514/tcp. The 1024 port restriction was useful in the days when administrators could fundamentally be trusted, and you could guarantee that a process running on a port < 1024 was authentic and not started by some mailcious user. It was a social means of ensuring a certain degree of security in the client ( a trust relationship), which assumption is not valid today. Devdas Bhagat ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Got root? We do. http://thinkgeek.com/sf _______________________________________________ linux-india-help mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/linux-india-help
