diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2016-02-17 05:29:04 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2016-02-17 16:37:56 +1100 |
| commit | c5c3f3279a0e4044b8de71b70d3570d692d0f29d (patch) | |
| tree | 72b85707e4fd5bd40a9184a88d09e8eed5e29897 | |
| parent | eb3f7337a651aa01d5dec019025e6cdc124ed081 (diff) | |
upstream commit
make sandboxed privilege separation the default, not just
for new installs; "absolutely" deraadt@
Upstream-ID: 5221ef3b927d2df044e9aa3f5db74ae91743f69b
| -rw-r--r-- | servconf.c | 6 | ||||
| -rw-r--r-- | sshd_config | 4 |
2 files changed, 5 insertions, 5 deletions
@@ -1,5 +1,5 @@ -/* $OpenBSD: servconf.c,v 1.284 2016/01/29 02:54:45 dtucker Exp $ */ +/* $OpenBSD: servconf.c,v 1.285 2016/02/17 05:29:04 djm Exp $ */ /* * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * All rights reserved @@ -356,9 +356,9 @@ fill_default_server_options(ServerOptions *options) assemble_algorithms(options); - /* Turn privilege separation on by default */ + /* Turn privilege separation and sandboxing on by default */ if (use_privsep == -1) - use_privsep = PRIVSEP_NOSANDBOX; + use_privsep = PRIVSEP_ON; #define CLEAR_ON_NONE(v) \ do { \ diff --git a/sshd_config b/sshd_config index 4d77f05a..a848d73e 100644 --- a/sshd_config +++ b/sshd_config @@ -1,4 +1,4 @@ -# $OpenBSD: sshd_config,v 1.97 2015/08/06 14:53:21 deraadt Exp $ +# $OpenBSD: sshd_config,v 1.98 2016/02/17 05:29:04 djm Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. @@ -107,7 +107,7 @@ AuthorizedKeysFile .ssh/authorized_keys #PrintLastLog yes #TCPKeepAlive yes #UseLogin no -UsePrivilegeSeparation sandbox # Default for new installations. +#UsePrivilegeSeparation sandbox #PermitUserEnvironment no #Compression delayed #ClientAliveInterval 0 |