Skip to content

Instantly share code, notes, and snippets.

@x1ppy
Created August 21, 2021 18:52
Show Gist options
  • Save x1ppy/a91533dde7c02bcfa6dffec85a6b57e6 to your computer and use it in GitHub Desktop.
Save x1ppy/a91533dde7c02bcfa6dffec85a6b57e6 to your computer and use it in GitHub Desktop.
Disable privilege separation in OpenSSH
diff --git a/trunk/PKGBUILD b/trunk/PKGBUILD
index a7c3f0d..9abf71b 100644
--- a/trunk/PKGBUILD
+++ b/trunk/PKGBUILD
@@ -64,6 +64,8 @@ build() {
--with-pid-dir=/run \
--with-default-path='/usr/local/sbin:/usr/local/bin:/usr/bin' \
+ patch --strip=1 < ../../junest.patch
+
make
}
diff --git a/trunk/junest.patch b/trunk/junest.patch
new file mode 100644
index 0000000..a3bbb9d
--- /dev/null
+++ b/trunk/junest.patch
@@ -0,0 +1,42 @@
+diff --git a/includes.h b/includes.h
+index 0fd7179..0cb7ecd 100644
+--- a/includes.h
++++ b/includes.h
+@@ -177,3 +177,11 @@
+ #include "entropy.h"
+
+ #endif /* INCLUDES_H */
++
++#ifndef JUNEST_OVERRIDE
++#define JUNEST_OVERRIDE
++#define initgroups(x,y) noop()
++#define setgroups(x,y) noop()
++static inline int
++noop() { return 0; }
++#endif /* JUNEST_OVERRIDE */
+diff --git a/sshd.c b/sshd.c
+index 11571c0..6184bac 100644
+--- a/sshd.c
++++ b/sshd.c
+@@ -235,7 +235,7 @@ static int *startup_flags = NULL; /* Indicates child closed listener */
+ static int startup_pipe = -1; /* in child */
+
+ /* variables used for privilege separation */
+-int use_privsep = -1;
++int use_privsep = 0;
+ struct monitor *pmonitor = NULL;
+ int privsep_is_preauth = 1;
+ static int privsep_chroot = 1;
+diff --git a/sshpty.c b/sshpty.c
+index bce09e2..20c9863 100644
+--- a/sshpty.c
++++ b/sshpty.c
+@@ -197,7 +197,7 @@ pty_setowner(struct passwd *pw, const char *tty)
+ tty, (u_int)pw->pw_uid, (u_int)gid,
+ strerror(errno));
+ else
+- fatal("chown(%.100s, %u, %u) failed: %.100s",
++ debug("chown(%.100s, %u, %u) failed: %.100s",
+ tty, (u_int)pw->pw_uid, (u_int)gid,
+ strerror(errno));
+ }
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment