Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: openssh chroot facility and directory access
Operating Systems AIX openssh chroot facility and directory access Post 302566417 by smurphy_it on Thursday 20th of October 2011 10:19:18 AM
Old 10-20-2011
openssh chroot facility and directory access
Good day. I currently have a request to have sftp access to a specific directory for a user(s). They can have access to that folder only, and nothing below it.

Now here is the gotcha that seems to be catching me. The folder they need access to is NOT owned by root, and most of the parent directories aren't either. I can't change this easily either, due to the "application" writing in these directories. Of course, the openssh chroot functionality relies on this to setup and secure the chroot environment.

I am wondering what is the best methodology to get this done? I was initially thinking of having a ChrootDirectory elsewhere, and then doing a bind mount, however, I don't know how 'secure' that would be.

layout:
Quote:
user app1 /home/user/appdir/archive (need SFTP access here)
user app1 /home/user/appdir (can't have SFTP access here, or any parent from here)
/etc/ssh/sshd_config specific contents:
Quote:
Subsystem sftp internal-sftp
Match Group sftponly
ChrootDirectory /chroot/home/user/appdir/
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
Quote:
oslevel -r
5300-12
Quote:
lslpp -l |grep openssh.base.server | uniq
openssh.base.server 5.4.0.6101 COMMITTED Open Secure Shell Server
Any suggestions ?
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Using the LOG_AUTH facility

Hi, I am wanting to enable logging of all ftp sessions on my Solaris 8 host. I want to at least log all ftp logins and if possible any commands that the user executes. I have tried various settings in syslog.conf then rereading syslogd but logging still does not happen. I have... (1 Reply)
Discussion started by: blp001
1 Replies

2. Solaris

openssh and chroot.

Hi all. I have installed openssh 5.3 and set up jailed root. It works almost as I want it to I cant cd to any directory above my ch root. my config : entry in passwd: test2:x:103:113::/users2/test2:/bin/false sshd_conf: Match User test2 ChrootDirectory /users2/%u # ... (4 Replies)
Discussion started by: vettec3
4 Replies

3. UNIX for Dummies Questions & Answers

Unable to use the CDE Facility

Hello I have a SunBlade 1000 workstation and I cannot login via CDE. All I get is a console login prompt. I then have to login via root and I just get the command line interface. I have being doing some research on the UNIX forum and the problem may lie with the content in etc/hosts file.... (7 Replies)
Discussion started by: tjwops
7 Replies

4. Debian

Secure ftp access to outside chroot

I want to setup ftp on my home server running debian 5.0 I found this guide and have read it carefully. Virtual Hosting With PureFTPd And MySQL (Incl. Quota And Bandwidth Management) On Debian Lenny | HowtoForge - Linux Howtos and Tutorials Before I install/config it I want to know if its... (1 Reply)
Discussion started by: chipmunken
1 Replies

5. UNIX for Advanced & Expert Users

chroot openssh access www folder

here is the setup<br/> sshd_config: <pre> Match User sftp ChrootDirectory /chroot/sftp </pre> I connect just fine to the folder <pre>/chroot/sftp</pre> However I cannot access the website developer folder due to it being outside the scope of the defined chrootdirectory... (2 Replies)
Discussion started by: dunpealslyr
2 Replies

6. AIX

OpenSSH built in chroot facility

Hi all, I'm trying to set up a chroot sftp using OpenSSH. But I'm still having problems. I'm using AIX 5.3 My system and OpenSSH version as follows host1:/>oslevel 5.3.0.0 host1:/>oslevel -r 5300-10 host1:/>ssh -V OpenSSH_5.0p1, OpenSSL 0.9.8h 28 May 2008 host1:/>lslpp -l | grep open... (2 Replies)
Discussion started by: h@foorsa.biz
2 Replies

7. Windows & DOS: Issues & Discussions

seteuid access denied - openSSH installation

Hi, I have installed openssh in one of my windows servers following SUA community guidelines. I can successfully install and generate RSA DSA keys. But I cannot SSH to server from my Solaris machine. Below is the output from ssh -v <server>. Also I tried to SSH from the K-shell to localhost... (0 Replies)
Discussion started by: vkk
0 Replies

8. Red Hat

Fedora-Kickstart, chroot cannot access to files been copied inside during %post -nochroot

Heyas I did try with several paths, and it ran several times, so i'm tired of rebuilt it (takes 30min and laptop is up to 90+C on cpu temp) just to see an empty skeleton dir. I once had the kickstart files in the root dir, but somehow the files retrieved from git, seem to be missing. Had... (2 Replies)
Discussion started by: sea
2 Replies

9. Ubuntu

No access to etc directory

Hi, I'm new to this... but I am unable to see /etc, however I can access it via gknautilus... but as superuser I'm getting told no such file or directory via terminal (15 Replies)
Discussion started by: GaryW
15 Replies

10. Red Hat

Chroot: cannot execute /bin/sh: No such file or directory

Hi Expert, I'm having grub problem here: grub> root (hd0,0): Filesystem type is ext2 grub> setup Error 11 : Unrecognized Device String I try install boot loader follow the instruction from 26.2. Booting into Rescue Mode It says : select Continue, it attempts to mount your file... (4 Replies)
Discussion started by: justbow
4 Replies

LEARN ABOUT OPENDARWIN

sftp-server

sftp-server(1M)                                           System Administration Commands                                           sftp-server(1M)

NAME

       sftp-server - SFTP server subsystem

SYNOPSIS

       /usr/lib/ssh/sftp-server

DESCRIPTION

       sftp-server implements the server side of the SSH File Transfer Protocol as defined in the IETF draft-ietf-secsh-filexfer.

       sftp-server is a subsystem for sshd(1M) and must not be run directly. There are no options or config settings.

       To enable the sftp-server subsystem for sshd add the following to /etc/ssh/sshd_config:

       Subsystem   sftp     /usr/lib/ssh/sftp-server

       See sshd_config(4) for a description of the format and contents of that file.

       There is no relationship between the protocol used by sftp-server and the FTP protocol (RFC 959) provided by in.ftpd.

EXIT STATUS

       The following exit values are returned:

       0        Successful completion.

       >0       An error occurred.

FILES

       /usr/lib/sftp-server

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE         |      ATTRIBUTE VALUE        |
       +-----------------------------+-----------------------------+
       |Availability                 |SUNWsshdu                    |
       +-----------------------------+-----------------------------+
       |Interface Stability          |Evolving                     |
       +-----------------------------+-----------------------------+

SEE ALSO

       sftp(1), ssh(1), ssh-add(1), ssh-keygen(1), sshd(1M), sshd_config(4), attributes(5)

       To  view  license  terms,  attribution,  and  copyright  for OpenSSH, the default path is /var/sadm/pkg/SUNWsshdr/install/copyright. If the
       Solaris operating environment has been installed anywhere other than the default, modify the given path to access the file at the installed
       location.

AUTHOR

       Markus Friedl

SunOS 5.10                                                          30 Jul 2003                                                    sftp-server(1M)
All times are GMT -4. The time now is 10:13 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy