20

I would like to setup a chroot jail for most (not all) users logging in though SSH. I've heard it's possible with the latest versions of openssh, but I've not been able to find out how to do it. The How To's all talk of patching an old version, and the patch is no longer available.

I'm running debian etch.

Improve this question
0

5 Answers 5

Reset to default
13

I am using rssh for this purpose.

You are right there is a new way to do it and it is a built-in feature of recent ssh versions.

Here is an article on Undeadly.

Improve this answer
6

I just had to setup one user who would be able to log in via ssh and the ssh to another server (which is not directly connected to the outside world). The links by cstamas and ericmayo were a good start.

Basically, I added the following to /etc/ssh/sshd_config:

Match User myuser
  ChrootDirectory /chroot/myuser

From there on, I just had to create the chroot environment below /chroot/myuser. I copied /bin/bash and /usr/bin/ssh and the shared libraries they needed (ldd will show those). For a larger environment, it would probably make sense to compile statically linked versions of the needed executables.

Bash worked right away, for ssh to work, I also had to create the .ssh directory, copy /etc/passwd, /etc/nsswitch.conf and /lib/libnss_* and create /dev/null, /dev/tty and /dev/urandom via mknod.

Improve this answer
2 
mkdir /chroot
mkdir -p /chroot/home/<user_name>

mkdir /chroot/home/<user-name>/bin  
cp -pr /bin/bash /chroot/home/<user_name>/bin/.  
cp -pr /bin/ls /chroot/home/<user_name>/bin/.  
cp -pr /lib64 /chroot/home/<user_name>/.

You have to edit the /etc/sshd_config file and addd

ChrootDirectory /chroot/%h

And restart sshd daemon.

All being said, I honestly think that sftp is a better option.

Also, I found this url if it is helpful.

http://www.techrepublic.com/blog/opensource/chroot-users-with-openssh-an-easier-way-to-confine-users-to-their-home-directories/229

Improve this answer
1

If you are using public-key authentication you could use the "command" option in authorized keys to setup the chroot jail.

~/.ssh/authorized_keys:

command="/path/to/the/chroot/script" ssh-dss keydata.....keydata... user@host
Improve this answer
1
  • I am not using Public key authentication, authentication is done by a password and username
    – Malfist
    Jul 13, 2009 at 17:19
0

As far as I know new versions of OpenSSH only allows chroot for SFTP connections. I tried and it works. But for SSH the solution available is the chrootssh patch. I browse the SourceForge site and there are no files so I think is discontinued.

For Debian Etch there are some files here: http://debian.home-dn.net/etch/ssh/

There are other solutions here: http://www.debian.org/doc/manuals/securing-debian-howto/ap-chroot-ssh-env.en.html , including chrootssh .

Improve this answer
1
  • -1 Sorry, your Answer was correct years ago when you wrote it, but no longer is.
    – Chris S
    Oct 8, 2012 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .