Monday, September 12, 2011

Why SSHD account cannot be removed

In modern SSHD, the privilege separation security feature is provided to allow SSHD to create unprivileged child process to deal with incoming network traffic. After successful authentication, another process will be created that has the privilege of the authenticated user. Privilege separation is to prevent privilege escalation by containing any corruption within the unprivileged processes.

Default setting in SSHD is 'yes', meaning its enabled. Hence, the account 'sshd' account with 'sshd' group is required by SSHD.

No comments: