https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2904 https://github.com/openssh/openssh-portable/blob/master/session.c#L1336 The directory to be chrooted must be root 755. It is inconvenient as it is forced without a way to solve it as an option. The CVE content says that you can do something with a combination of hardlink and setuid, Isn't this a problem related to openssh that occurs when another account executes? I would like to take this vulnerability and make it impossible to detect the existence of other accounts when logged in. Please make it an option. thank you. if(!options->unsecure_chroot_directory) { if (st.st_uid != 0 || (st.st_mode & 022) != 0)
Sorry, but this has been discussed extensively in the past (e.g. this thread https://marc.info/?t=122641302700006&r=1&w=2) and we do not intend to make changes to ChrootDirectory permission requirements. The CVE you mention occurred because Redhat ignored this and patched their sshd to relax these requirements. It never affected the version of OpenSSH that we ship.
Closing bugs from openssh-9.1 release cycle