I'm working on a OpenSSH server installation on Solaris 11.3. When I build OpenSSH 7.7p1 from source and install it make dies at the end after installing the components:

$ sudo gmake install

/usr/gnu/bin/mkdir -p /usr/local/etc
/usr/local/etc/ssh_config already exists, install will not overwrite
/usr/local/etc/sshd_config already exists, install will not overwrite
/usr/local/etc/moduli already exists, install will not overwrite
/usr/local/sbin/sshd -t -f /usr/local/etc/sshd_config
Privilege separation user sshd does not exist
gmake: [check-config] Error 255 (ignored)

When I check Solaris' existing installation:

$ /usr/bin/ssh -V
Sun_SSH_2.2, SSH protocols 1.5/2.0, OpenSSL 0x1000110f

$ sudo id sshd
id: invalid user name: "sshd"

$ cat /etc/ssh/sshd_config | grep -i privilege

So the stock OpenSSH is kind of old and does not use the feature.

Here are my points of contention:

  • Privilege separation has been around since at least 2003
  • The OpenSSH portability team decided privilege separation should be used on this platform
  • The Solaris team decided decided privilege separation should not be used on this platform
  • Solaris may provide complimentary security controls, like roles, in lieu of privilege separation

Additional information includes (1) no useful information about Solaris install in the OpenSSH docs, and (2) questions for the Solaris build and install to the SSH mailing list went unanswered.

So my question is, do I (1) follow Solaris and drop privilege separation; or (2) follow best practice and use privilege separation?

Or maybe a combination, like (1) use privilege separation and (2) add SSHD to a network role? (I'm still investigating the other security controls applied to /usr/lib/sunssh/lib/sshd).

  • Does the sshd user exist? – Andrew Henle Jul 23 '18 at 20:14
  • @AndrewHenle - No, the user does not exist. – user56041 Jul 23 '18 at 20:30
  • Try creating it ? To /etc/group add sshd:x:74:, to /etc/passwd add sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin – steve Jul 23 '18 at 20:39
  • 2
    Sun_SSH != OpenSSH. Instead of doing this manually, installing the OpenSSH package from Oracle will most likely already have all the required users and security controls handled for you: pkg install network/openssh – GracefulRestart Jul 23 '18 at 22:28
  • 2
    If the version string still says Sun_SSH_2.2 then that is not OpenSSH. The document I linked had instructions on how to set the default ssh to OpenSSH after it had been installed: pkg set-mediator -I openssh ssh. ed25519 is supported since OpenSSH 6.5 and ecdsa is supported since OpenSSH 5.7. Though I would not be surprised if Oracle does not build a recent package of OpenSSH that provides those functionalities. – GracefulRestart Jul 23 '18 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy