Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a user who is jailed.

sshd_config:

Subsystem sftp internal-sftp

Match user matt
     ChrootDirectory %h
     X11Forwarding no
     AllowTcpForwarding no

passwd:

matt:x:1001:5006:Matt Ryan,,,:/home/matt:/home/matt/bin/bash

This works perfectly for sftp. The user is limited to his home folder, and whatever mounts are there.

But, I'd like to also give this use shell access. This is what happens when they attempt to log in:

$ ssh matt@server.com
Linux devnode 2.6.38-linode31 #1 SMP Mon Mar 21 21:22:33 UTC 2011 i686 GNU/Linux
Ubuntu 10.04.2 LTS

Welcome to Ubuntu!
 * Documentation:  https://help.ubuntu.com/
Last login: Thu Mar 31 13:04:29 2011 from abc.nyc.res.rr.com
/home/matt/bin/bash: No such file or directory
Connection to server.com closed.

Via fstab, the bin folder is mounted to the home directory and is present.

Why am I getting this error.. and how can I solve this?

Thanks for the help!

share|improve this question

1 Answer 1

up vote 3 down vote accepted

When you chroot, the named directory becomes /. The correct shell path inside the chroot is then /bin/bash, not /home/matt/bin/bash.

You will also need to make sure there's enough other stuff inside the chroot for the system to work. You can test this with sudo chroot /home/matt /bin/bash and see what works and what doesn't; at the very least, you will probably want a dummy /etc, a bind mount of /proc, and much of /lib inside the chroot.

share|improve this answer
    
@geekosaur, thanks a lot... i just mounted the entire /proc and /lib folders to his home to test and it was successful. another question though, are bind mounts costly in anyway? –  matt ryan Mar 31 '11 at 17:45
    
Bind mounts are essentially free. –  geekosaur Mar 31 '11 at 17:46
    
great. one more for bonus: how can i enable color support for this user's shell –  matt ryan Mar 31 '11 at 18:14
    
GNU ls wants some setup done by scripts in /etc/profile.d. Some programs may also want to see /usr/share/terminfo/*/*. –  geekosaur Mar 31 '11 at 18:19
    
seriously, thanks for you help. i'm having trouble bind mounting the /usr/bin here though. is there a better way to enable access to that? –  matt ryan Mar 31 '11 at 18:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.