openssh unix dev - Feb 2022 - "UsePrivilegeSeparation no" is useful for running sshd without privileges

Hi OpenSSH developers,

"UsePrivilegeSeparation no" causes sshd to not use setuid when
starting
up.  This is useful for running sshd without any privileges in the first
place.  That is, running sshd as an unprivileged user, rather than as
root.

There are a number of uses for this.  In particular, I do this as part
of a test suite, where I run sshd to test some code which uses the SSH
protocol.  Requiring root to run my test suite is quite undesirable.

UsePrivilegeSeparation is currently deprecated, and prints a warning
message when used.

I suggest that UsePrivilegeSeparation should be explicitly supported for
running sshd as non-root.  Perhaps "UsePrivilegeSeparation no" should
not print a warning message when sshd is running as non-root; or perhaps
there should be a "UsePrivilegeSeparation unprivileged" which causes
sshd to abort if it's running as root.  Or perhaps something else
entirely; in any case, I hope UsePrivilegeSeparation is not removed,
since it is useful for this purpose.

Thanks!

On Tue, 8 Feb 2022 at 06:16, Spencer Baugh <sbaugh at catern.com>
wrote:
> "UsePrivilegeSeparation no" causes sshd to not use setuid when
starting
> up.  This is useful for running sshd without any privileges in the first
> place.  That is, running sshd as an unprivileged user, rather than as
> root.
"UsePrivilegeSeparation yes" (or just omitting it) works as an
unprivileged user.  All of our regression tests can (and do) run that
way.  At one point it required that the privsep user and directory
exist, although it didn't use them, but that was fixed nearly five
years ago[0].
> I suggest that UsePrivilegeSeparation should be explicitly supported for
> running sshd as non-root.
No, supporting UsePrivilegeSeparation=no, that means there will still
be two different code paths.    Running sshd as non-root is supported
with UsePrivilegeSeparation=yes.

[0] https://marc.info/?l=openssh-unix-dev&m=150206569108938&w=2

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.