Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In the openssh Red Hat package, I noticed that the ssh-agent executable has the SGID permission set:

$ ls -l /usr/bin/ssh-agent
-rwxr-sr-x 1 root nobody 113648 Nov 24  2010 /usr/bin/ssh-agent

Why would the openssh developers want ssh-agent to run with the nobody group? Or maybe I am misunderstanding what SGID does?

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

Well, mine's setgid to the ssh group. I'm guessing you're on a RedHat-derived system; they love to abuse the nobody user/group.

A bit of googling suggests that the setgid is to prevent a security vulnerability whereby secret key material is obtained by ptracing the agent (http://comments.gmane.org/gmane.linux.debian.devel.ssh/59). Making the process setgid-anything means that ptracing by non-root (or at least non-CAP_SYS_PTRACE) users is EPERMed.

share|improve this answer
    
Thank you for leading me the right direction. Appreciate it. –  Beaming Mel-Bin Jul 16 '11 at 14:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.