up vote 0 down vote favorite
share [g+] share [fb]

I am running Ubuntu 10.04 and I'm trying to add an sftp-only user to log in using public key authentication.

My sshd_config has the following configuration:

Subsystem sftp internal-sftp

Match Group sftponly
    ChrootDirectory /sftponly
    AllowTCPForwarding no
    X11Forwarding no
    ForceCommand internal-sftp
Match

And my user is set up having a home directory outside the chroot, from which the public key is checked and it works normally. However, when I try to log in, I get:

sftp sftpuser@server
Connecting to server...
sftp> ls
Connection closed

My auth.log is clean - as far as I can see, the auth.log just informs of the disconnected connection, nothing more. Even if I set sshd to log with DEBUG.

When attaching strace to this sftp process, I get the following (before disconnection):

connect(4, {sa_family=AF_FILE, path="/var/lib/sss/pipes/nss"}, 110) = -1 ENOENT (No such file or directory)

If I manually add a passwd and group entry inside the chroot, which should not be necessary, I get a bit further than that, but:

connect(4, {sa_family=AF_FILE, path="/dev/log"}, 110) = -1 ENOENT (No such file or directory)

Files inside the chroot should not be required by internal-sftp when using a new-ish version of OpenSSH. What am I doing wrong here?

I have a feeling this relates to this redhat bug but I'm not sure.

link|improve this question
Is the a true Chroot ? ie are all the needed libs and file in the chroot ? How did you creat the chroot environment ? The error above may indicate that the process is being called in its chroot but cannot find any of the files and libs it need to run. – AndyM Jun 28 '11 at 14:57
What's sssd and where does it fit in to your problem ? – Iain♦ Jun 29 '11 at 6:57
Indeed, it seemed that some of the files were missing in the chroot environment. – tstm Aug 1 '11 at 20:40
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.