diff options
| author | Damien Miller <djm@mindrot.org> | 2008-05-19 14:28:19 +1000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2008-05-19 14:28:19 +1000 |
| commit | 56f41ddc5472ef04f20c59ec94a74825b8439898 (patch) | |
| tree | 185e28de74dae3d74aad899ebda0a9a4089fe108 /sshd_config.5 | |
| parent | 797e3d117f8b4cfed5f066ef88f28826eb8f8b41 (diff) | |
| download | openssh-git-56f41ddc5472ef04f20c59ec94a74825b8439898.tar.gz | |
- djm@cvs.openbsd.org 2008/04/04 06:44:26
[sshd_config.5]
oops, some unrelated stuff crept into that commit - backout.
spotted by jmc@
Diffstat (limited to 'sshd_config.5')
| -rw-r--r-- | sshd_config.5 | 37 |
1 files changed, 2 insertions, 35 deletions
diff --git a/sshd_config.5 b/sshd_config.5 index be386971..601b5640 100644 --- a/sshd_config.5 +++ b/sshd_config.5 @@ -34,8 +34,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd_config.5,v 1.85 2008/04/04 05:14:38 djm Exp $ -.Dd $Mdocdate: April 4 2008 $ +.\" $OpenBSD: sshd_config.5,v 1.86 2008/04/04 06:44:26 djm Exp $ +.Dd $Mdocdate: May 19 2008 $ .Dt SSHD_CONFIG 5 .Os .Sh NAME @@ -210,29 +210,6 @@ in-process sftp server is used (see .Cm Subsystem for details). .Pp -Please note that there are many ways to misconfigure a chroot environment -in ways that compromise security. -These include: -.Pp -.Bl -dash -offset indent -compact -.It -Making unsafe setuid binaries available; -.It -Having missing or incorrect configuration files in the chroot's -.Pa /etc -directory; -.It -Hard-linking files between the chroot and outside; -.It -Leaving unnecessary -.Pa /dev -nodes accessible inside the chroot (especially those for physical drives); -.It -Executing scripts or binaries inside the chroot from outside, either -directly or through facilities such as -.Xr cron 8 . -.El -.Pp The default is not to .Xr chroot 2 . .It Cm Ciphers @@ -363,11 +340,6 @@ Specifying a command of will force the use of an in-process sftp server that requires no support files when used with .Cm ChrootDirectory . -Note that -.Dq internal-sftp -is only supported when -.Cm UsePrivilegeSeparation -is enabled. .It Cm GatewayPorts Specifies whether remote hosts are allowed to connect to ports forwarded for the client. @@ -830,11 +802,6 @@ server. This may simplify configurations using .Cm ChrootDirectory to force a different filesystem root on clients. -Note that -.Dq internal-sftp -is only supported when -.Cm UsePrivilegeSeparation -is enabled. .Pp By default no subsystems are defined. Note that this option applies to protocol version 2 only. |