Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up jailkit on one of my servers which is running Debian 5. I created a new ssh user (bob) and a chroot directory for him (/var/www/bob). I gave the chroot the extshellplusnet and limitedshell options with the following commands:

jk_init -c /etc/jailkit/jk_init.ini -j /var/www/bob/ extshellplusnet
jk_init -c /etc/jailkit/jk_init.ini -j /var/www/bob/ limitedshell

And then I jailed him:

jk_jailuser -m -j /var/www/bob bob

When I try to ssh in as bob, it connects, I get the banner, and then it disconnects. My auth.log looks like this:

Aug 25 05:04:36 server sshd[29885]: Accepted password for bob from 123.45.6.7 port 50624 ssh2
Aug 25 05:04:36 server sshd[29885]: pam_unix(sshd:session): session opened for user bob by (uid=0)
Aug 25 05:04:36 server jk_chrootsh[29942]: now entering jail /var/www/bob for user bob (1001) with arguments 
Aug 25 05:04:36 server sshd[29885]: pam_unix(sshd:session): session closed for user bob

My non-jailed users work just fine, and I don't seem to be getting any permission errors. Any ideas?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

Firstly turn you SSH logs to DEBUG3 by replacing in the sshd_config file : LogLevel INFO by LogLevel DEBUG3

You will see more information why SSH did close the connection.

Then Ensure you have all the shell need to run in chrooted environment :

  • The user home is there with the right permissions
  • All shell need to be lauched in the chroot directory (shell executable and all librairies)
  • All the components such as passwd, group, hosts, nsswitch.conf, resolv.conf, shadow are in the /var/www/bob/etc
  • The null pseudo device is the /var/www/bob/dev directory. You can create it typing : mknod /var/www/bob/dev/null c 1 3
  • Then if it still does not work, I recommand you to debug your chroot environment with the strace command.

strace chroot /var/www/bob/ /bin/bash

share|improve this answer
1  
Everything looked good, I even straced a good user and the jailed user and those matched up (other than memory mapping, but that's expected). I ended up copying /bin/bash to the chroot and changing the jailed user to use /bin/bash instead of /usr/sbin/jk_lsh as the shell, and it worked. /usr/sbin/jk_lsh exists in the chroot, so I'm not sure what is going on. –  dragonmantank Aug 25 '11 at 14:15
    
You also can strace the /usr/sbin/jk shell to see why it doesn't work. strace is your best friend when chrooting environments. –  DrGkill Aug 27 '11 at 5:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.