I need to create a chroot jail on my RHEL5 production server to allow a specific user to work with the less right possible, but with GIT.
Here is my system configuration :
- RHEL 5 : Release 5.10
- OpenSSH : OpenSSH_6.4p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
I've created, for testing, a folder /chroot with a subfolder toto where I want to chroot my user.
# ls -la /chroot
total 24
drwxr-xr-x 3 root root 4096 Nov 11 15:22 .
drwxr-xr-x 31 root root 4096 Nov 12 13:02 ..
drwxr-xr-x 5 root root 4096 Nov 11 15:22 toto
# ls -la /chroot/toto
total 40
drwxr-xr-x 5 root root 4096 Nov 11 15:22 .
drwxr-xr-x 3 root root 4096 Nov 11 15:22 ..
drwxr-xr-x 2 root root 4096 Nov 11 15:22 bin
drwxr-xr-x 2 root root 4096 Nov 11 15:22 lib
drwxr-xr-x 5 root root 4096 Nov 11 15:22 usr
I've created a chroot group named chroot_www and added my user toto to it.
I've edited /etc/ssh/sshd_config and added the necessary lines at the end.
#Subsystem sftp /usr/libexec/openssh/sftp-server
Subsystem sftp internal-sftp
Match Group chroot_www
# ForceCommand internal-sftp
ChrootDirectory /chroot/toto
AllowTcpForwarding no
But when I want to connect with ssh I get this error :
ssh toto@********
toto@********'s password:
Last login: Thu Nov 14 13:22:35 2013 from ********
Could not chdir to home directory /chroot/toto: No such file or directory
Connection to ******** closed.
but the directory exists, and the rights are good.
And it's strange for two reason :
- I've got the same configuration on a RHEL6 server and it's working.
- I can connect with SFTP and I'm chroot jailed in the right folder, but I can't with SSH.
So I'm really interested if you got experience with chroot jail or problem like this one...