- djm@cvs.openbsd.org 2012/07/10 02:19:15

     [servconf.c servconf.h sshd.c sshd_config]
     Turn on systrace sandboxing of pre-auth sshd by default for new installs
     by shipping a config that overrides the current UsePrivilegeSeparation=yes
     default. Make it easier to flip the default in the future by adding too.

diff --git a/ChangeLog b/ChangeLog
index 885a721ffcb44a3ae93ecb2538f0363f60d6f8e9..911b4b1145999ffd8145ef47ab1f2f04067f50cd 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,11 @@
    - jmc@cvs.openbsd.org 2012/07/06 06:38:03
      [ssh-keygen.c]
      missing full stop in usage();
+   - djm@cvs.openbsd.org 2012/07/10 02:19:15
+     [servconf.c servconf.h sshd.c sshd_config]
+     Turn on systrace sandboxing of pre-auth sshd by default for new installs
+     by shipping a config that overrides the current UsePrivilegeSeparation=yes
+     default. Make it easier to flip the default in the future by adding too.
 
 20120720
  - (dtucker) Import regened moduli file.

diff --git a/servconf.c b/servconf.c
index eccfbad48e064b6af46dbc6a04648dcf7edc68fe..427bdeef13c8680459e3ea3a3d97b21f9ca08afc 100644 (file)
--- a/servconf.c
+++ b/servconf.c
@@ -1,5 +1,5 @@
 
-/* $OpenBSD: servconf.c,v 1.227 2012/06/19 18:25:27 markus Exp $ */
+/* $OpenBSD: servconf.c,v 1.228 2012/07/10 02:19:15 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -285,7 +285,7 @@ fill_default_server_options(ServerOptions *options)
                options->version_addendum = xstrdup("");
        /* Turn privilege separation on by default */
        if (use_privsep == -1)
-               use_privsep = PRIVSEP_ON;
+               use_privsep = PRIVSEP_NOSANDBOX;
 
 #ifndef HAVE_MMAP
        if (use_privsep && options->compression == 1) {
@@ -770,8 +770,9 @@ static const struct multistate multistate_gatewayports[] = {
        { NULL, -1 }
 };
 static const struct multistate multistate_privsep[] = {
-       { "sandbox",                    PRIVSEP_SANDBOX },
-       { "yes",                        PRIVSEP_ON },
+       { "yes",                        PRIVSEP_NOSANDBOX },
+       { "sandbox",                    PRIVSEP_ON },
+       { "nosandbox",                  PRIVSEP_NOSANDBOX },
        { "no",                         PRIVSEP_OFF },
        { NULL, -1 }
 };

diff --git a/servconf.h b/servconf.h
index c2eeed66519718671e050b3cfe7f6b2c519d6407..096d596d7c81fd8a012d331c4021f06f532d3d67 100644 (file)
--- a/servconf.h
+++ b/servconf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.h,v 1.102 2012/06/19 18:25:28 markus Exp $ */
+/* $OpenBSD: servconf.h,v 1.103 2012/07/10 02:19:15 djm Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -39,7 +39,7 @@
 /* use_privsep */
 #define PRIVSEP_OFF            0
 #define PRIVSEP_ON             1
-#define PRIVSEP_SANDBOX                2
+#define PRIVSEP_NOSANDBOX      2
 
 #define DEFAULT_AUTH_FAIL_MAX  6       /* Default for MaxAuthTries */
 #define DEFAULT_SESSIONS_MAX   10      /* Default for MaxSessions */

diff --git a/sshd.c b/sshd.c
index 64b846f6ceb94a8339cf12dfb1b9a190269e0b76..9aff5e8afd34880dfa0b44d15864604e7289984e 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.392 2012/06/30 14:35:09 markus Exp $ */
+/* $OpenBSD: sshd.c,v 1.393 2012/07/10 02:19:15 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -635,7 +635,7 @@ privsep_preauth(Authctxt *authctxt)
        /* Store a pointer to the kex for later rekeying */
        pmonitor->m_pkex = &xxx_kex;
 
-       if (use_privsep == PRIVSEP_SANDBOX)
+       if (use_privsep == PRIVSEP_ON)
                box = ssh_sandbox_init();
        pid = fork();
        if (pid == -1) {

diff --git a/sshd_config b/sshd_config
index ec3ca2afc1fe59827182fa935d9f68cacd9bf057..9424ee2c644a5540b72cdc1ac2b1419e399338a4 100644 (file)
--- a/sshd_config
+++ b/sshd_config
@@ -1,4 +1,4 @@
-#      $OpenBSD: sshd_config,v 1.86 2012/04/12 02:43:55 djm Exp $
+#      $OpenBSD: sshd_config,v 1.87 2012/07/10 02:19:15 djm Exp $
 
 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.
@@ -99,7 +99,7 @@ AuthorizedKeysFile    .ssh/authorized_keys
 #PrintLastLog yes
 #TCPKeepAlive yes
 #UseLogin no
-#UsePrivilegeSeparation yes
+UsePrivilegeSeparation sandbox         # Default for new installations.
 #PermitUserEnvironment no
 #Compression delayed
 #ClientAliveInterval 0