Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In the openssh Red Hat package, I noticed that the ssh-agent executable has the SGID permission set:

$ ls -l /usr/bin/ssh-agent
-rwxr-sr-x 1 root nobody 113648 Nov 24  2010 /usr/bin/ssh-agent

Why would the openssh developers want ssh-agent to run with the nobody group? Or maybe I am misunderstanding what SGID does?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

Well, mine's setgid to the ssh group. I'm guessing you're on a RedHat-derived system; they love to abuse the nobody user/group.

A bit of googling suggests that the setgid is to prevent a security vulnerability whereby secret key material is obtained by ptracing the agent (http://comments.gmane.org/gmane.linux.debian.devel.ssh/59). Making the process setgid-anything means that ptracing by non-root (or at least non-CAP_SYS_PTRACE) users is EPERMed.

share|improve this answer
    
Thank you for leading me the right direction. Appreciate it. –  Belmin Fernandez Jul 16 '11 at 14:02
    
Why the group ownership of ssh-agent is noboby not root? –  Ask and Learn Jul 7 at 6:58
    
@AskandLearn: Because if it runs SGID root, it has root-equivalent powers, and so any vulnerability in ssh-agent would suddenly be a root-level vulnerability -- which would be very, very bad. –  womble Jul 8 at 10:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.