From owner-freebsd-security  Tue Jun 25  0:29:19 2002
Delivered-To: freebsd-security@freebsd.org
Received: from smtp.web.de (smtp01.web.de [194.45.170.210])
	by hub.freebsd.org (Postfix) with ESMTP id E76EA37B40A
	for <freebsd-security@freebsd.org>; Tue, 25 Jun 2002 00:27:42 -0700 (PDT)
Received: from [217.82.32.109] (helo=floundjan.homeip.net)
	by smtp.web.de with esmtp (WEB.DE(Exim) 4.70 #5)
	id 17Mkjl-0002rt-00; Tue, 25 Jun 2002 09:27:41 +0200
Received: from localhost (localhost.lan [127.0.0.1])
	by floundjan.homeip.net (Postfix on FreeBSD 4.5) with ESMTP
	id BFE1A1D1; Tue, 25 Jun 2002 09:27:31 +0200 (CEST)
Received: from jan-linnb.lan (jan-linnb.lan [192.168.0.25])
	by floundjan.homeip.net (Postfix on FreeBSD 4.5) with ESMTP
	id 7FAF3DD; Tue, 25 Jun 2002 09:27:28 +0200 (CEST)
Subject: Re: How to check if "UsePrivilegeSeparation" works in OpenSSH?
From: Jan Lentfer <Jan.Lentfer@web.de>
To: patpro <patpro@patpro.net>
Cc: FreeBSD Security Maillinglist <freebsd-security@FreeBSD.ORG>
In-Reply-To: <E59ABC95-880A-11D6-919D-0030654D97EC@patpro.net>
References: <E59ABC95-880A-11D6-919D-0030654D97EC@patpro.net>
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Mailer: Ximian Evolution 1.0.7 
Date: 25 Jun 2002 09:26:33 +0200
Message-Id: <1024989993.2078.20.camel@jan-linnb.lan>
Mime-Version: 1.0
X-Virus-Scanned: by AMaViS perl-10
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Am Die, 2002-06-25 um 09.12 schrieb patpro:

> just log in (via ssh of course) and type :
> 
> $ ps -aux | grep sshd | grep -v grep
> 
> and make sure it gives something like this :
> 
> root     178  0.0  1.3  2088 1180  ??  Is  4:40PM  0:00.20 /usr/local/sbin/
> sshd
> root   61294  0.0  1.8  4868 1656  ??  I   8:21AM  0:00.05 sshd: patpro 
> [priv] (sshd)
> patpro 61296  0.0  1.9  5000 1744  ??  S   8:21AM  0:00.14 sshd: patpro@ 
> ttyp0 (sshd)
> 
> 
> first process : regular sshd daemon,
> second : spawned root limited process,
> third : active process with limited privileges. (spawned from the 2nd 
> process if I understand correctly)

Thanks a lot, I guess I have it working then, since I see the same on my
box now. Maybe I am on the safe side now for longer than 2 weeks :-). I
have Diploma exams in a few weeks - it seems like exploits always WAIT
to come out when I REALLY don't have time :-)

Thanks again,

Jan


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message