3

A user connects via ssh. The user is also chroot-ed to their home directory. The goal is security.

Since the user is chroot-ed, when they login /bin/bash is not found. Obviously the user needs shell commands.

Shell access can be provided by
1) symlink /bin/bash to /home/username
2) mount --bind via /etc/fstab - preferred option because the servers often reboot.

Is there a difference in security between these 2 options?
Or is there a 3rd, more secure option?

1 Answer 1

2
  1. Symlink will not help you. You will need not only the /bin/sh, but the libraries. And special devices like /dev/null or /dev/zero. And more things. Best way is not only symlink, but the hardlink. And system update will be VERY tricky.

  2. mount looks a little better, but you better look at autofs - so, it could mount the user directory only when it is needed, e.g. when user logs in.

I prefer using LXC. It's like advanced chroot, so you can run different operating systems usign your kernel. And chroot users to their own systems. This cause more disk usage, but separation of users looks sweet.

Nice post series from LXC author

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .