Ssh Privilege Separation

The separation of ssh privileges-Linux Enterprise Application-Linux server application information. For details, refer to the following section. The so-called Privilege Separation is actually an OpenSSH security mechanism, similar to the security that chroot can provide. This feature is enabled by default. The UsePrivilegeSeparation command in the configuration file can be used to enable or disable this feature.

The key to using this feature is to set an empty directory, set the permission of this directory to "000", and set the host to "root ". Then you need to set a non-privileged user for privileged separation, such as sshd, and set the user's home directory to this empty directory. For example, you can use the following command:

# Mkdir-p/var/empty
# Chown 0: 0/var/empty
# Chmod 000/var/empty
# Groupadd sshd
# Useradd-g sshd-c 'sshd privsep'-d/var/empty-s/bin/false sshd

Then, when running the configuration script, use

-- With-privsep-path =/var/empty
-- With-privsep-user = sshd

To specify directories and users.