04-14-2010
Read up on chroot. As soon as a process changes it's root directory, it can't access the files outside anymore. Shell, utilities, password file, ... are out of reach (invisible even). You'll have to set up a minimal environment yourself inside the chroot, mirroring that of a real system.
10 More Discussions You Might Find Interesting
1. News, Links, Events and Announcements
See:
http://www.cert.org/advisories/CA-2002-36.html
and
http://www.rapid7.com/News/pr021216-ssh.html (1 Reply)
Discussion started by: Neo
1 Replies
2. UNIX for Advanced & Expert Users
I am trying to ssh into a remote sun server, however I get X11 forwarding error. I have checked sshd_config file and X11 forwarding is enabled.
Also xhost command doesnt give any output, it doesnt even return the prompt.I have to Ctrl C out of the situation. any suggestions anyone?? (1 Reply)
Discussion started by: ysk
1 Replies
3. UNIX for Dummies Questions & Answers
I was reading an article on how it is very important to setup a chroot jail to run bind. I can follow what the article says but one thing I am unclear about is now on system boot the BIND process in the chroot jail will start since it the owner will no longer be root but some other user. Can... (1 Reply)
Discussion started by: mojoman
1 Replies
4. UNIX for Advanced & Expert Users
Hi all,
I have a Solaris 10 server with SUN_SSH_1.1 installed.
I want to restrict a user via SFTP to only be able to access one directory. I've written a little script in .profile which works perfectly for an ssh login but it appears sftp doesn't read the .profile file so it doesn't work.
... (2 Replies)
Discussion started by: Donkey25
2 Replies
5. UNIX for Advanced & Expert Users
I have a simple sandbox program which runs a command as user "nobody" in a chroot jail. It sets resource limits with setrlimit, changes the user id with setuid, changes the root dir with chroot, and then calls exec to execute the command given as command line parameters. It is of course a... (8 Replies)
Discussion started by: john.english
8 Replies
6. Solaris
Hello all, does anybody knows a procedure to enable an chroot for users using ssh and sftp ? Thanks (1 Reply)
Discussion started by: celord
1 Replies
7. UNIX for Advanced & Expert Users
I have a developer that needs ssh access to a server to get to a specific directory. I want to restrict them to that directory. I've tried to set their shell as rksh which does jail them but only if they are using ssh from another unix system. If they are using putty or winscp they can still... (2 Replies)
Discussion started by: toor13
2 Replies
8. Red Hat
Hi
I need a specific user to be able to sftp to a server and get files from a specific location. The location is not the users home dir, i don't want the user to be able to view anything else apart from the files in that area.
e.g ftp file are is - /logging/phplogs
e.g user home is... (1 Reply)
Discussion started by: duckeggs01
1 Replies
9. Solaris
I'm attempting to setup RSA Authentication for a particular user on two servers. A script runs via crontab, logs into one server and transfers data from the server1 to server2. Another script via cron, runs on server2, connects to server 1 and transfers data to it. However, I'm having issues... (3 Replies)
Discussion started by: Nvizn
3 Replies
10. UNIX for Beginners Questions & Answers
For some reason, when I try copying my public key to the server, despite it showing as being successful:
rob@linux044:~$ ssh-copy-id -i /home/rob/Work/Keys/keys.txt.pub !@#$%.com
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/rob/Work/Keys/keys.txt.pub"... (7 Replies)
Discussion started by: Circuits
7 Replies
LEARN ABOUT MOJAVE
chroot
CHROOT(2) BSD System Calls Manual CHROOT(2)
NAME
chroot -- change root directory
SYNOPSIS
#include <unistd.h>
int
chroot(const char *dirname);
DESCRIPTION
Dirname is the address of the pathname of a directory, terminated by an ASCII NUL. chroot() causes dirname to become the root directory,
that is, the starting point for path searches of pathnames beginning with '/'.
In order for a directory to become the root directory a process must have execute (search) access for that directory.
If the program is not currently running with an altered root directory, it should be noted that chroot() has no effect on the process's cur-
rent directory.
If the program is already running with an altered root directory, the process's current directory is changed to the same new root directory.
This prevents the current directory from being further up the directory tree than the altered root directory.
This call is restricted to the super-user.
RETURN VALUES
Upon successful completion, a value of 0 is returned. Otherwise, a value of -1 is returned and errno is set to indicate an error.
ERRORS
chroot() will fail and the root directory will be unchanged if:
[ENOTDIR] A component of the path name is not a directory.
[ENAMETOOLONG] A component of a pathname exceeded {NAME_MAX} characters, or an entire path name exceeded {PATH_MAX} characters.
[ENOENT] The named directory does not exist.
[EACCES] Search permission is denied for any component of the path name.
[ELOOP] Too many symbolic links were encountered in translating the pathname.
[EFAULT] Path points outside the process's allocated address space.
[EIO] An I/O error occurred while reading from or writing to the file system.
SEE ALSO
chdir(2)
WARNINGS
There are ways for a root process to escape from the chroot jail.
HISTORY
The chroot() function call appeared in 4.2BSD.
4.2 Berkeley Distribution June 4, 1993 4.2 Berkeley Distribution