I have a multi-user server, which puts a subset of the users in a chroot. I want to allow all users to call
passwd in order to change their respective password. Everything else I can think of is either overkill or likely to compromise system-security.
I build my chroot with
makejail using the following configuration.
chroot="/var/chroot/sshd" cleanJailFirst=1 # these are binds to the actual location, hence, we don't want makejail to be tinkering with those. preserve=["/home","/etc/passwd","/etc/group","/srv"] testCommandsInsideJail=["bash","sh","ls","pwd","stat","whoami","svnserve -t","locale","localedef","man ssh","man scp","cat","nano","vim","ssh","scp","passwd"] testCommandsOutsideJail= packages=["coreutils"] # speed up things a bit sleepAfterStartCommand=0.8 sleepAfterTest=0.8
As you can see, in
testCommandsInsideJail, I listed
passwd, but if I login as my testuser (who is inside that chroot), I get:
$ passwd Changing password for test. (current) UNIX password: passwd: Authentication token manipulation error passwd: password unchanged
which I don't understand unfortunately (before you ask, yes, I am sure the password I entered is correct). I have found some sites via g, which help me as little as the actual error message. To my understanding, I am missing some pam module, but I don't know how to add it to the python script that builds the jail.
I am running Ubuntu Server 10.04.
I have the actual
/etc/passwd bound (via
/etc/fstab) to the location of the chroot passwd, which is in
/var/chroot/sshd/etc/passwd, so modifications inside the chroot are seen from the outside. I have now also done the same with
/etc/shadow, which for some reason I forgot before. So instead of
I have now
and an additional bind:
# chroot binds /home /var/chroot/sshd/home none bind 0 0 /etc/passwd /var/chroot/sshd/etc/passwd none bind 0 0 /etc/shadow /var/chroot/sshd/etc/shadow none bind 0 0 /etc/group /var/chroot/sshd/etc/group none bind 0 0 /srv /var/chroot/sshd/srv none bind 0 0
If I try to change the password now, I get
$ passwd Changing password for test. (current) UNIX password: Enter new UNIX password: Retype new UNIX password: passwd: Authentication token manipulation error passwd: password unchanged
passwd manages to check the current password, but dies when it comes to setting it.