Date: 26 May 2003 19:02:30 +0200 From: "G.P. de Boer" <g.p.de.boer@st.hanze.nl> To: Fernando Schapachnik <fernando@mecon.gov.ar> Cc: freebsd-security@freebsd.org Subject: Re: sshd doing dns queries on localhost? Message-ID: <1053968550.574.3.camel@edinburgh> In-Reply-To: <20030526163255.GJ637@bal740r0.mecon.gov.ar> References: <20030526163255.GJ637@bal740r0.mecon.gov.ar>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 2003-05-26 at 18:32, Fernando Schapachnik wrote: <something about DNS lookups when SSH'ing> This is becoming a FAQ. Current OpenSSH daemons implement a feature called 'privilege seperation', which splits the daemon in two: one part running as root, the other as user 'sshd' (or whatever you define), minimalizing security threats. One disadvantage though: /etc/resolv.conf is read AFTER chroot()ing to the directory '/var/empty' (talking about OpenSSH in base). If resolv.conf can't be found there, sshd will lookup IP's via 127.0.0.1, generating those log_in_vain messages you see. How to solve? Well.. copy /etc/resolv.conf to /var/empty/etc/. Regards, Pieter
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1053968550.574.3.camel>