how on earth does openssh not only have incredibly fucked versioning but is the only package i've ever seen to mention a "privilege separation" chroot path which actively breaks non-root builds. are you fucking kidding me bruh. "privilege separation chroot" defaulting to /var/empty and it immediately errors if it can't create it????? why are your version strings like that bruh?????
120
Replies
·
0
Boosts
ok so they decided to reinvent sudo for sshd root https://github.com/openssh/openssh-portable/blob/master/README.privsep if i cannot disable the sshd build (reading ./configure --help in a crazed demented rage did not see the flag for it) i'm going to commit several murders
how do you spend 8kb of text and provide multiple detailed ASCII art diagrams regarding your privilege separation methodology and oh my god wait does it really require sshd to be root too yes it literally does are you fucking kidding me
this is so fucked
sshd is the main entry-point binary for the server. This binary retains privilege but performs a very limited set of tasks: loading and checking the configuration, listening for incoming connections
and monitoring the status of connections through the pre-authentication phase of their lifecycle to implement the MaxStartups and PerSourcePenalties features.
NONE OF THESE THINGS REQUIRE ROOT WHAT THE FUCK
how is anyone ok with this????? it takes half the document and two fork/execs before it gets to why sshd-auth would need root:
All operations that require privilege, such as looking up user information, private key signatures, checking passwords, etc are performed by RPC to the parent sshd-session process.
- looking up user information????????
- i think you can calculate cryptographic signatures without root????
- the fuck do you mean """"checking passwords"""""
@hipsterelectron bestie do you know what ssh, like, is
@haskal i thought it was an RPC protocol
@hipsterelectron one way to log in 2 ssh is with a username and password. that's what is meant by looking up user information and checking passwords
@haskal thanks to @lunabee i have aged 500 years in an instant https://cathode.church/@lunabee/116965608768380463
@hipsterelectron @lunabee okay? uninstall ssh then. you can authenticate to your computer over the network via uhhhh ummmmm uhhh well im sure you'll figure it out
@haskal i did not intend to insult you and i'm sorry. you also described exactly the same thing and crediting her was not intended to dismiss your very patient responses. i thought i had made it clear my goal is just to build/install the openssh client and not the server and it's really annoying they don't consider that an obvious thing someone might want to do. i am surprised at each one of the sshd-auth operations indeed requiring root, all of which have exposed to me new details of the unix security model. i do in fact appreciate you spending the time to teach me that.
@hipsterelectron Maybe I'm VASTLY missing the point here, but doesn't listening on port 22 require root, because 22 is a privileged port? Isn't there a tradition of servers being forced to use root on linux for this reason even if they don't need it for other reasons?
@hipsterelectron changing user to the target user after login requires root
