Subject: Re: fun with ssh (was: anoncvs not working)
To: admin@datazap.net <admin@datazap.net>
From: David S. <davids@idiom.com>
List: netbsd-help
Date: 12/21/2003 14:29:49
> 
> After looking at the problem again, I think I was wrong about it being a
> compiling problem. First of all, only the sshd child process uses alot of
> cpu time, and that is only when I use protocol 1. I updated pkgsrc
> again, and rebuilt the openssh without ipv6 support and now the problem
> has basically gone away. Although now it spawns 2 child processes. Is this
> normal behaviour (without ipv6 support)?

Recent versions of openssh spawn two processes per connection because
they use "privilege separation".  One process, running under the connecting
user's ID does most of the "work" of the protocol, while the other, running
under 'root', does the tasks that require 'root' privileges.  The intention
of this strategy is to make SSH less vulnerable to 'root' compromises.

David S.

>