Re: Ports 0-1023?

Robert Bihlmeyer wrote:
> What's the point in stripping root from sshd if it is able to run a
> shell as any user (including root)?

With the proposed change, sshd could only get root if someone with the
actual root password comes along and hands it to the sshd. With the
existing scheme, any remote vulnerabilities in the sshd code that happen
before it can drop privs will yield root without the password for the root
account.

Which is exactly what I was after.

                                                BB
Received on Jul 08 2002