Bet you didn’t know that wolfSSH has its own stand-alone server application for use on POSIX systems, wolfSSHd. It’ll load OpenSSH style configuration files and will look up users on the local system. It also uses wolfSSH’s built in SFTP service. It doesn’t have privilege separation.
In 2023 we are planning on adding privilege separation to wolfSSHd when built for POSIX systems. This will not be available in embedded builds as they don’t typically have the concept of multiple users; everything runs in privileged mode.
A method for privilege separation was published in the paper “Preventing Privilege Escalation” by Provos et al. The general idea is to separate your server application into two applications. One runs as a privileged user and handles things like signing blobs of data, providing pseudo random numbers, and authenticating users. The other runs as an unprivileged user and runs the shell and monitors the socket. The two applications communicate using IPC of some form, like shared memory and pipes.
wolfSSH is lovingly crafted by wolfSSL Inc in the Pacific Northwest. If you have any questions or comments please contact us at facts@wolfssl.com