A chroot on Unix operating systems is an operation that changes the apparent root directory for the current running process and its children.

learn more… | top users | synonyms

2
votes
4answers
4k views

Prevent rssh users from leaving their jail directories

I'm attempting to use rssh to jail users strictly to their /home/user/public_html dirctories. I got it to work where an account can SFTP into the system successfully on a test server, but once I login ...
2
votes
4answers
4k views

Webserver: chrooted PHP gives mysql.sock error when attempting to reach mysql

Hey guys, I've configured an Ubuntu webserver with Nginx + PHP5-FPM. I've created a chrooted environment (using jailkit) that I'm tossing my developers into, from where they can develop their test ...
2
votes
2answers
855 views

Is Chrooting apache/mysql/php a standard practice of securing web servers containing sensitive data?

Is Chrooting apache/mysql/php a standard practice of securing web servers containing sensitive data (is it necessary)?
2
votes
2answers
13k views

How to run tomcat6 on ubuntu as root?

I've got an existing software package that runs on Ubuntu that uses a chroot jail and so needs to be run as root. I want to exec this from a java web application running within Tomcat6 on Ubuntu, so ...
2
votes
2answers
1k views

Chroot for Mysql running on Ubuntu 10.10?

Prompted from a question about MySQL server security best practices, I've been running through this list (with a few minor alterations) to properly secure my server database server: ...
2
votes
2answers
322 views

Apache Error Log - “Web Path” instead of Filesystem Path

I'm running Apache on Linux and I'm using OpenSSH to provide SFTP access to some customers so they can upload their pages and also look at their respective site logs (access & error). I'm using ...
2
votes
2answers
1k views

What is the right way to chroot perl script?

I created /opt/chroot, create bin lib and other directories in it, copied libraries, bash and perl binaries in proper places. Also I placed my script into /opt/chroot/bin/. Now I can run the script ...
2
votes
1answer
192 views

A proper way to create a chrooted SSH on CentOS 7 [closed]

There are a lot of tutorials of how to create a chrooted SFTP, but I would like to use SSH, because it is much faster to simply wget, unzip, mysql and mysqldump than tossing around the FTP and ...
2
votes
1answer
198 views

How to 'apt-get upgrade' a debootstraped chroot jail from outside?

I have a daemon running in a chroot jail that I have generated with debootstrap. I'd like to remove apt and dpkg from the jail, but I want to keep the other packages updated. Can I upgrade the ...
2
votes
2answers
676 views

SFTP post upload hook

How would I run a script after a file has been successfully uploaded over (a chrooted) SFTP? I have this working on standard FTP connection using PureFTP ...
2
votes
2answers
6k views

User can't SFTP after chroot

Ubuntu 10.04.4 LTS I'm trying to chroot the user 'sam'. According to all the articles out there this should work, but apparently I'm still doing something wrong. The user: ...
2
votes
3answers
684 views

bind9 in a chroot jail - necessary or not?

I always used to keep my bind9 installation in a chroot jail. Now I upgraded my vServer and have to install bind9 over again. Due to the virtualization solution my hosting provider uses, I cannot ...
2
votes
1answer
898 views

Debian: ip/network changes within chroot/jail

I've Debian Squeeze running and setup a chroot environment (/jail) with debootstrap. As seen in a tutorial, I mounted the following: proc on /jail/proc type proc (rw) devpts on /jail/dev/pts type ...
2
votes
2answers
1k views

Is it advisable to run Apache in a chroot jail?

I have been advised by a sysadmin guy I know, to run Apache in a chroot jail, for increased security. I have the following questions: Is this advisable (i.e. are there any 'gotcha's that I need to ...
2
votes
2answers
1k views

Is MySecureShell a good way to manage SFTP user with chroot on a Centos Server?

I need to setup my Centos 5.4 server for SFTP with chrooted access only (or equivalent). The regular solution using RSSH find here : ...
2
votes
1answer
88 views

Set Initial Remote Working Directory in SFTP

I am running Amazon Linux AMI (Red Hat derivative), and am creating a new SFTP server using OpenSSH. I would like for the SFTP user to be restricted to a directory, and to be able to write to the ...
2
votes
1answer
1k views

VSFTPD how chroot not chrooted users in /home?

I need to chroot all local users to their home directories, but one user should have access to all user directories. If I put admin_user in chroot_list_file he has access for whole file system. I want ...
2
votes
1answer
259 views

Security implications of mount --bind in a chroot environment

Assume you have a chroot environment where you need a resource - an application or a library - which resides on the host (external to the chroot). Which are the security implications (if any) of ...
2
votes
2answers
664 views

Is it possible to mount a subdirectory as the root file system at kernel startup?

I'm trying to install a linux from sources inside my home directory(as oposed to creating a dedicated partition). The basic system(glibc, kernel and init) is installed at $HOME/lfs/root. I'm booting ...
2
votes
1answer
2k views

Running BIND9 In chroot

I am trying to running bind9, on a ubuntu box, in a chroot jail, as discussed in "Linux System Administration" (Adelstein & Lubanovic). The command "sudo /etc/init.d/bind9 start" is generating ...
2
votes
2answers
2k views

nginx+php-fpm(chroot). No input file specifed

OS: Centos PHP: 5.5.6 Nginx: 1.4.4 Nginx conf server { listen 80; server_name example.ltd; root /srv/example.ltd/www; index index.php; access_log /srv/example.ltd/logs/nginx-main.log main; ...
2
votes
2answers
781 views

How to setup a public rsync and sftp server

I want to setup a public storage server which allows sftp and rsync (through ssh). I've got it working with a chroot jail and rssh. When the user connects to the server with sftp he can read all the ...
2
votes
3answers
4k views

ubuntu bind9 AppArmor read permission denied (chroot jail)

I am trying to run bind9 with chroot jail. I followed the steps mentioned at : http://www.howtoforge.com/debian_bind9_master_slave_system I am getting the following errors in my syslog: Jul 27 ...
2
votes
2answers
1k views

Setup secure shared hosting (Apache, PHP, MySQL)

So I'm setting up a shared hosting with Apache, PHP, MySQL and the biggest question mark is how to do with PHP, since there is a million options out there how to configure it securely. The plan is: ...
2
votes
2answers
241 views

Security of chroot and linux binaries

I'd like to verify the security of chroot and default programs in a linux distribution (say Ubuntu). Example: I set up jail directory 'A'. Every linux binary from the distribution is placed in 'A' ...
2
votes
1answer
393 views

Updating (and configuring) chroots on general purpose CentOS webserver with yum?

I'm currently providing web hosting on a shared web hosting VPS environment - that has no chroot. This is obviously a big security concern, although I've made sure that only the owners of files can ...
2
votes
1answer
1k views

Is there an available repository to update OpenSSH to 4.8+ on Centos 5.4?

I need OpenSSH 4.8+ in order to do setup a clean chrooted SFTP on my Centos 5.4 with Remi and EPEL repositories. Is there a repository for Centos which contain an updated OpenSSH? Thanks! Extra ...
2
votes
0answers
27 views

chpasswd apply changes in the chroot directory [migrated]

I have debootstraped version of wheezy on my Archlinux machine and would like to change it's root password: echo "root:toor" | chpasswd --root /home/containers/wheezy/ However I get an error: ...
2
votes
2answers
280 views

can not run java inside grsec chroot

java runs well inside common chroot. however in a grsec hardened chroot it complains it has no enough memory to build VM. any ideas of how to make it run cause i really need a hardened chroot. ...
2
votes
3answers
1k views

Setting up a chroot sftp on debian server

I'm trying to allow a user "user" to access my server by either sftp or ssh. I want to jail them into a directory with chroot. I read the instructions here however it does not work. I did the ...
2
votes
2answers
70 views

Jail on a http only server

Does it make sense to set up a chroot jail for a apache server which is the only service on the server? Or it is pointless, because the server is in either way lost if it get hacked?
1
vote
1answer
402 views

chroot user to var/www/html

Can I limit a user login through sftp only can see and change files under var/www/html folder? I tried below, but then I can't login in Transmit through sftp # adduser user_www # passwd user_www # ...
1
vote
2answers
1k views

When is it not worth putting Apache in a chroot jail?

I don't mean to question the well established security precaution of putting apache in a chroot-jail in most scenarios but in my scenario I have doubts. We have a virtual server hosting a single ...
1
vote
3answers
3k views

SFTP to chroot and SSH to manage system in one config?

We have a webserver where users are allowed to upload (SFTP) large files in a chroot environment. We also want to be able to use SSH to manage this server. In our old situation we used the system ...
1
vote
1answer
3k views

Is it possible to allow key based authentication for sshd_cofnig chroot sftp users?

I'm running an Ubuntu 12.04.1 LTS (GNU/Linux 3.2.0-30-generic x86_64) Server, with OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012. I'd like to configure chroot for sftp access using ...
1
vote
4answers
993 views

Restrict users to their home directory

How do I restrict the user to his current directory only? I tried the steps mentioned on this page to configure rssh chroot jail to lock users to their home directories only, but this looks too ...
1
vote
3answers
884 views

Help on chroot sftp user

I have 5 sites all under /home/mainuser. I have created user in /home/user1, currently the sftp works and the user is jailed to his folder. However, I want it to have access to 2 sites in ...
1
vote
1answer
382 views

Chroot with SSH connections doesn't work

I have found How can I chroot ssh connections? and a lot of different blog articles and similar (http://undeadly.org/cgi?action=article&sid=20080220110039, ...
1
vote
2answers
4k views

Chrooted SFTP user - Write permission denied even for owner

On CentOS release 6.5 (Final) I created a restricted user test1 useradd -s /bin/false test1 and configured ssd_config as following Subsystem sftp internal-sftp Match User test1 ...
1
vote
1answer
976 views

setlocale error with chroot

I have created a chroot jail and when I log in I get a bash warning bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8) I tried to google the error, but wasn't able to find a ...
1
vote
2answers
318 views

CHROOT for shell script testing

I am looking at setting up a shell script in order to properly document and automate the process I am using to setup a few servers we have. In order to test the shell script through its different ...
1
vote
1answer
391 views

question about chroot

I used chroot to install Debian Lenny on my Ubuntu desktop. I have now decided I will no longer be using Debian and so I want to remove Debian and install Ubuntu server in a chroot instead. My ...
1
vote
1answer
935 views

chroot'ing SSH home directories, shell problem

I am trying to chroot my SSH users to their home directories and it seems to work.. in a strange way. Here is what I have in my sshd_config: Match group restricthome ChrootDirectory %h The ...
1
vote
2answers
2k views

scponly worked but didn't chroot the home folder, the user can still browse the entire server

So I followed the "Chroot and Debian" tutorial in http://sublimation.org/scponly/wiki/index.php/FAQ Then when I log into user "upload" via ssh I have no access to the command line (this is what I ...
1
vote
1answer
1k views

How to set chroot for SFTP under Ubuntu 8.04?

Ubuntu 8.04 LTS comes with OpenSSH 4.7, before the ChrootDirectory parameter was introduced. How can I upgrade OpenSSH to 4.9+? Alternatively, without upgrading OpenSSH, how can I set chroot?
1
vote
3answers
6k views

RHEL 5.4 & Chrooted SFTP

According to release notes, RHEL 5.4 included an update to setup chrooted SFTP accounts natively. But from what I am seeing, it is all or nothing--This means that even root is chrooted if you go this ...
1
vote
1answer
831 views

openssh sftp chroot: two levels of access

I would like to achieve the following with OpenSSH's internal-sftp, chroot and Match directive: Users belonging to group sftpuser should have read and write access to /srv/sftp/{username} (or ...
1
vote
1answer
227 views

How can I find out the path to a chrooted environment in which a particular daemon was started?

I have a setup with several directories where I can chroot and start the same daemon from. I'd like to be able to tell from which of my multiple directories I started the daemon. I'd like to find it ...
1
vote
2answers
1k views

Implications that come with chrooting php-fpm

I am creating a production server that will run nginx with php-fpm. I want to have a good mix between securing the server, and still having good quick workflow. Now one thing that always secures the ...
1
vote
2answers
347 views

sendmail not working

I'm trying to use the mail() function in PHP on a Debain Linux server. I have 2 web servers running. One is in a chrooted setup. The server that's not chrooted works fine, the other one wont send ...