I’m setting up a Linux machine (CentOS7) and am trying to allow tap/tun tunneling. Our organization’s security policy prohibits root logins. Using OpenSSH server 7.4 (as provided by the CentOS repositories) non-root users are able to open tunnels as long as the sshd_config has The setting UsePrivilegeSeparation=no. All is well, but I wonder what security risks I am taking by disabling the separation. Also, I would like to update to a more current version of the server for security as well as for the SSH_TUNNEL environment variable introduced in 7.7, but the UsePrivilegeSeparation option has been deprecated and a current version (8.3p) refuses to run with that option present in the config file. Removing the option, the ioctl() to create the tun/tap interface fails, just like with 7.4. Now that privilege separation is a requirement, is the only way forward to allow root logins and authorize the client users by copying their public key into root’s authorized_keys file? If this is the case, I would be giving up per-user auditing, requiring keys instead of password (or PAM-based) authentication, as well as the ability to use Match blocks to control which users/groups/hosts are allowed to create tunnels and which are allowed normal sessions. Is this on the roadmap for future consideration? -Thanks, Travis _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
