HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

Most remote command execution requests from the client are nonprivileged, and are
handled by a shell spawned under this nonprivileged child sshd process. When the
nonprivileged child sshd process needs a privileged function to be executed, it
communicates with its privileged parent sshd process using a UNIX pipe.
Privilege separation helps contain potential damage from an intruder. For example, if
a buffer overflow attack occurs during a shell command execution, control is within
the nonprivileged process, thereby containing the potential security risk.
NOTE: Privilege separation is the default configuration for HP-UX Secure Shell. You
can turn off privilege separation by setting UsePrivilegeSeparation NO in the
sshd_config file. Because of the potential security risk, turn off privilege separation
only after careful consideration.
4.6.5 HP-UX Secure Shell Authentication
HP-UX Secure Shell supports the following authentication methods:
• GSS-API (Kerberos-based client authentication)
• Public key authentication
• Host-based authentication
• Password authentication
When a client connects with a remote sshd daemon, it selects the desired authentication
method (one of the methods listed previously), and either presents the appropriate
credentials as part of the connection request or responds to a prompt sent back by the
server. All authentication methods work in this way.
The server requires the appropriate key, pass phrase, password, or credentials from
the client to establish a successful connection.
You can choose to have the sshd instance support only a subset of the supported
authentication methods based on security requirements.
Although HP-UX Secure Shell supports the authentication methods listed previously,
system administrators can limit the authentication methods offered by an sshd instance,
based on the specific security requirements of their environment. For example, an
HP-UX Secure Shell environment can dictate that all clients must authenticate using
the public key or Kerberos methods. As a result, may disable the remaining methods.
The enabling and disabling of supported authentication methods is through
configuration directives specified in the sshd_config file.
When an ssh client connection request is made, the server first responds with its list
of supported authentication methods. This list represents the authentication methods
supported by the sshd server and the sequence in which these methods will be tried.
The client can omit one or more of those authentication methods. The client can also
change the sequence in which the methods are attempted. You achieve this with a
configuration directive in the client configuration file, /opt/ssh/etc/ssh_config.
80 Remote Access Security Administration