Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: openssh chroot facility and directory access
Operating Systems AIX openssh chroot facility and directory access Post 302566417 by smurphy_it on Thursday 20th of October 2011 10:19:18 AM
Old 10-20-2011
openssh chroot facility and directory access
Good day. I currently have a request to have sftp access to a specific directory for a user(s). They can have access to that folder only, and nothing below it.

Now here is the gotcha that seems to be catching me. The folder they need access to is NOT owned by root, and most of the parent directories aren't either. I can't change this easily either, due to the "application" writing in these directories. Of course, the openssh chroot functionality relies on this to setup and secure the chroot environment.

I am wondering what is the best methodology to get this done? I was initially thinking of having a ChrootDirectory elsewhere, and then doing a bind mount, however, I don't know how 'secure' that would be.

layout:
Quote:
user app1 /home/user/appdir/archive (need SFTP access here)
user app1 /home/user/appdir (can't have SFTP access here, or any parent from here)
/etc/ssh/sshd_config specific contents:
Quote:
Subsystem sftp internal-sftp
Match Group sftponly
ChrootDirectory /chroot/home/user/appdir/
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
Quote:
oslevel -r
5300-12
Quote:
lslpp -l |grep openssh.base.server | uniq
openssh.base.server 5.4.0.6101 COMMITTED Open Secure Shell Server
Any suggestions ?
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Using the LOG_AUTH facility

Hi, I am wanting to enable logging of all ftp sessions on my Solaris 8 host. I want to at least log all ftp logins and if possible any commands that the user executes. I have tried various settings in syslog.conf then rereading syslogd but logging still does not happen. I have... (1 Reply)
Discussion started by: blp001
1 Replies

2. Solaris

openssh and chroot.

Hi all. I have installed openssh 5.3 and set up jailed root. It works almost as I want it to I cant cd to any directory above my ch root. my config : entry in passwd: test2:x:103:113::/users2/test2:/bin/false sshd_conf: Match User test2 ChrootDirectory /users2/%u # ... (4 Replies)
Discussion started by: vettec3
4 Replies

3. UNIX for Dummies Questions & Answers

Unable to use the CDE Facility

Hello I have a SunBlade 1000 workstation and I cannot login via CDE. All I get is a console login prompt. I then have to login via root and I just get the command line interface. I have being doing some research on the UNIX forum and the problem may lie with the content in etc/hosts file.... (7 Replies)
Discussion started by: tjwops
7 Replies

4. Debian

Secure ftp access to outside chroot

I want to setup ftp on my home server running debian 5.0 I found this guide and have read it carefully. Virtual Hosting With PureFTPd And MySQL (Incl. Quota And Bandwidth Management) On Debian Lenny | HowtoForge - Linux Howtos and Tutorials Before I install/config it I want to know if its... (1 Reply)
Discussion started by: chipmunken
1 Replies

5. UNIX for Advanced & Expert Users

chroot openssh access www folder

here is the setup<br/> sshd_config: <pre> Match User sftp ChrootDirectory /chroot/sftp </pre> I connect just fine to the folder <pre>/chroot/sftp</pre> However I cannot access the website developer folder due to it being outside the scope of the defined chrootdirectory... (2 Replies)
Discussion started by: dunpealslyr
2 Replies

6. AIX

OpenSSH built in chroot facility

Hi all, I'm trying to set up a chroot sftp using OpenSSH. But I'm still having problems. I'm using AIX 5.3 My system and OpenSSH version as follows host1:/>oslevel 5.3.0.0 host1:/>oslevel -r 5300-10 host1:/>ssh -V OpenSSH_5.0p1, OpenSSL 0.9.8h 28 May 2008 host1:/>lslpp -l | grep open... (2 Replies)
Discussion started by: h@foorsa.biz
2 Replies

7. Windows & DOS: Issues & Discussions

seteuid access denied - openSSH installation

Hi, I have installed openssh in one of my windows servers following SUA community guidelines. I can successfully install and generate RSA DSA keys. But I cannot SSH to server from my Solaris machine. Below is the output from ssh -v <server>. Also I tried to SSH from the K-shell to localhost... (0 Replies)
Discussion started by: vkk
0 Replies

8. Red Hat

Fedora-Kickstart, chroot cannot access to files been copied inside during %post -nochroot

Heyas I did try with several paths, and it ran several times, so i'm tired of rebuilt it (takes 30min and laptop is up to 90+C on cpu temp) just to see an empty skeleton dir. I once had the kickstart files in the root dir, but somehow the files retrieved from git, seem to be missing. Had... (2 Replies)
Discussion started by: sea
2 Replies

9. Ubuntu

No access to etc directory

Hi, I'm new to this... but I am unable to see /etc, however I can access it via gknautilus... but as superuser I'm getting told no such file or directory via terminal (15 Replies)
Discussion started by: GaryW
15 Replies

10. Red Hat

Chroot: cannot execute /bin/sh: No such file or directory

Hi Expert, I'm having grub problem here: grub> root (hd0,0): Filesystem type is ext2 grub> setup Error 11 : Unrecognized Device String I try install boot loader follow the instruction from 26.2. Booting into Rescue Mode It says : select Continue, it attempts to mount your file... (4 Replies)
Discussion started by: justbow
4 Replies

LEARN ABOUT NETBSD

pam_chroot

PAM_CHROOT(8)						    BSD System Manager's Manual 					     PAM_CHROOT(8)

NAME

     pam_chroot -- Chroot PAM module

SYNOPSIS

     [service-name] module-type control-flag pam_chroot [arguments]

DESCRIPTION

     The chroot service module for PAM chroots users into either a predetermined directory or one derived from their home directory.  If a user's
     home directory as specified in the passwd structure returned by getpwnam(3) contains the string ``/./'', the portion of the directory name to
     the left of that string is used as the chroot directory, and the portion to the right will be the current working directory inside the chroot
     tree.  Otherwise, the directories specified by the dir and cwd options (see below) are used.

     also_root	Do not hold user ID 0 exempt from the chroot requirement.

     always	Report a failure if a chroot directory could not be derived from the user's home directory, and the dir option was not specified.

     cwd=directory
		Specify the directory to chdir(2) into after a successful chroot(2) call.

     dir=directory
		Specify the chroot directory to use if one could not be derived from the user's home directory.

SEE ALSO

     pam.conf(5), pam(8)

AUTHORS

     The pam_chroot module and this manual page were developed for the FreeBSD Project by ThinkSec AS and NAI Labs, the Security Research Division
     of Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (``CBOSS''), as part of the DARPA CHATS research program.

BSD
								 February 10, 2003							       BSD
All times are GMT -4. The time now is 11:04 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy