A chroot on Unix operating systems is an operation that changes the apparent root directory for the current running process and its children.

learn more… | top users | synonyms (1)

3
votes
3answers
5k views

Proftpd: How to set default root to a users home directory without jailing the user?

I've installed proftpd on my debian box but I'm having having some trouble with the configuration. In my proftpd.conf I've added; DefaultRoot ~ !ftp_special This works fine in that all users ...
3
votes
1answer
297 views

df shows too much space on tmpfs

I have a server (SLES 11 running on a VMware hypervisor if that matters) with a tmpfs partition meant for mysql temporary tables, and I run mysql chrooted. df -h gives me strange outpupt: root@db12....
3
votes
2answers
951 views

How to setup a public rsync and sftp server

I want to setup a public storage server which allows sftp and rsync (through ssh). I've got it working with a chroot jail and rssh. When the user connects to the server with sftp he can read all the ...
3
votes
1answer
1k views

Increasing permissiveness/permissions for umask + openssh + chrooted SFTP server using internal-sftp

The suggestion found at these links works for me: How to setup ssh's umask for all type of connections http://ubuntuforums.org/showthread.php?t=1107974#5 Summary: Use PAM to inject the umask, ...
2
votes
3answers
759 views

Disable Linux Commands

I'm writing a simple program to back-up some files to a Linux box. The transaction will take place over SSH and each copy of the program will have its own account on the Linux box that it will ...
2
votes
2answers
4k views

Access files outside a chroot'ed environment?

I need to setup some users to access our server. I thought the most secure way to allow them access was to setup a chroot'ed jail for them to log into. But I need them to access a few select ...
2
votes
2answers
2k views

Virtualmin Chroot FTP Users [closed]

Can someone tell me how to chroot FTP users with Virtualmin, if it is possible.
2
votes
4answers
5k views

Webserver: chrooted PHP gives mysql.sock error when attempting to reach mysql

Hey guys, I've configured an Ubuntu webserver with Nginx + PHP5-FPM. I've created a chrooted environment (using jailkit) that I'm tossing my developers into, from where they can develop their test ...
2
votes
1answer
592 views

chroot user to var/www/html

Can I limit a user login through sftp only can see and change files under var/www/html folder? I tried below, but then I can't login in Transmit through sftp # adduser user_www # passwd user_www # ...
2
votes
5answers
2k views

How secure is SSH ForceCommand on a jump host?

I have the following setup in my network: Internet <--> Bastion <--> Local Network I have several users and each user is assigned to a specific machine. Or in other words: Each user ...
2
votes
2answers
887 views

SFTP post upload hook

How would I run a script after a file has been successfully uploaded over (a chrooted) SFTP? I have this working on standard FTP connection using PureFTP http://linux.die.net/man/8/pure-...
2
votes
3answers
1k views

Defining hard links in puppet

Is there a way to define hardlinks inside puppet manifest? It seems file type can only define symbolic links, but I need it to be hard links in order to make some of my chrooted applications to work. ...
2
votes
2answers
897 views

Is Chrooting apache/mysql/php a standard practice of securing web servers containing sensitive data?

Is Chrooting apache/mysql/php a standard practice of securing web servers containing sensitive data (is it necessary)?
2
votes
2answers
15k views

How to run tomcat6 on ubuntu as root?

I've got an existing software package that runs on Ubuntu that uses a chroot jail and so needs to be run as root. I want to exec this from a java web application running within Tomcat6 on Ubuntu, so ...
2
votes
2answers
1k views

What is the right way to chroot perl script?

I created /opt/chroot, create bin lib and other directories in it, copied libraries, bash and perl binaries in proper places. Also I placed my script into /opt/chroot/bin/. Now I can run the script ...
2
votes
1answer
155 views

Home/end keys are not working correctly in the bash CLI for a jailed user using PuTTY

I'm using PuTTY to access my U14.04 LTS server via SSH. When I log in using my main account, the number pad keys work fine in the BASH CLI. When I log in to a user who's been jailed using Jailkit, ...
2
votes
1answer
4k views

Is it possible to allow key based authentication for sshd_cofnig chroot sftp users?

I'm running an Ubuntu 12.04.1 LTS (GNU/Linux 3.2.0-30-generic x86_64) Server, with OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012. I'd like to configure chroot for sftp access using ...
2
votes
1answer
1k views

PHP-FPM Chroot jail corrupts timezone db?

I'm trying to setup a PHP-FPM Chroot jail on a new CentOS 6.3 box. I can get the chroot to work fine, in the sense that I can get php scripts to respond and echo things out. But, every time I use the ...
2
votes
2answers
1k views

Chroot for Mysql running on Ubuntu 10.10?

Prompted from a question about MySQL server security best practices, I've been running through this list (with a few minor alterations) to properly secure my server database server: http://www....
2
votes
2answers
334 views

Apache Error Log - “Web Path” instead of Filesystem Path

I'm running Apache on Linux and I'm using OpenSSH to provide SFTP access to some customers so they can upload their pages and also look at their respective site logs (access & error). I'm using ...
2
votes
1answer
997 views

chroot'ing SSH home directories, shell problem

I am trying to chroot my SSH users to their home directories and it seems to work.. in a strange way. Here is what I have in my sshd_config: Match group restricthome ChrootDirectory %h The ...
2
votes
1answer
3k views

A proper way to create a chrooted SSH on CentOS 7 [closed]

There are a lot of tutorials of how to create a chrooted SFTP, but I would like to use SSH, because it is much faster to simply wget, unzip, mysql and mysqldump than tossing around the FTP and ...
2
votes
1answer
434 views

How to 'apt-get upgrade' a debootstraped chroot jail from outside?

I have a daemon running in a chroot jail that I have generated with debootstrap. I'd like to remove apt and dpkg from the jail, but I want to keep the other packages updated. Can I upgrade the ...
2
votes
1answer
1k views

openssh sftp chroot: two levels of access

I would like to achieve the following with OpenSSH's internal-sftp, chroot and Match directive: Users belonging to group sftpuser should have read and write access to /srv/sftp/{username} (or similar,...
2
votes
2answers
8k views

User can't SFTP after chroot

Ubuntu 10.04.4 LTS I'm trying to chroot the user 'sam'. According to all the articles out there this should work, but apparently I'm still doing something wrong. The user: sam:x:1005:1006::/home/...
2
votes
3answers
717 views

bind9 in a chroot jail - necessary or not?

I always used to keep my bind9 installation in a chroot jail. Now I upgraded my vServer and have to install bind9 over again. Due to the virtualization solution my hosting provider uses, I cannot ...
2
votes
1answer
1k views

Debian: ip/network changes within chroot/jail

I've Debian Squeeze running and setup a chroot environment (/jail) with debootstrap. As seen in a tutorial, I mounted the following: proc on /jail/proc type proc (rw) devpts on /jail/dev/pts type ...
2
votes
2answers
1k views

Is it advisable to run Apache in a chroot jail?

I have been advised by a sysadmin guy I know, to run Apache in a chroot jail, for increased security. I have the following questions: Is this advisable (i.e. are there any 'gotcha's that I need to ...
2
votes
2answers
1k views

Is MySecureShell a good way to manage SFTP user with chroot on a Centos Server?

I need to setup my Centos 5.4 server for SFTP with chrooted access only (or equivalent). The regular solution using RSSH find here : http://www.cyberciti.biz/tips/howto-linux-unix-rssh-chroot-jail-...
2
votes
1answer
439 views

Set Initial Remote Working Directory in SFTP

I am running Amazon Linux AMI (Red Hat derivative), and am creating a new SFTP server using OpenSSH. I would like for the SFTP user to be restricted to a directory, and to be able to write to the ...
2
votes
1answer
298 views

Security implications of mount --bind in a chroot environment

Assume you have a chroot environment where you need a resource - an application or a library - which resides on the host (external to the chroot). Which are the security implications (if any) of ...
2
votes
1answer
602 views

Is there an equivalent of ToLower for a vsftpd.conf?

I am running a vsFTP server using virtual users. I chroot each user to their own personal subdirectory. For ease of use I would like to make my usernames case-insensitive, but I am having some ...
2
votes
2answers
796 views

Is it possible to mount a subdirectory as the root file system at kernel startup?

I'm trying to install a linux from sources inside my home directory(as oposed to creating a dedicated partition). The basic system(glibc, kernel and init) is installed at $HOME/lfs/root. I'm booting ...
2
votes
1answer
2k views

Running BIND9 In chroot

I am trying to running bind9, on a ubuntu box, in a chroot jail, as discussed in "Linux System Administration" (Adelstein & Lubanovic). The command "sudo /etc/init.d/bind9 start" is generating ...
2
votes
1answer
37 views

Create a Web User

I am running Apache 2.4.8 on Arch Linux, but that doesn't matter really. I would like to create a user who is devoted to web management. I have created a user, a group, and added the user to the ...
2
votes
2answers
2k views

nginx+php-fpm(chroot). No input file specifed

OS: Centos PHP: 5.5.6 Nginx: 1.4.4 Nginx conf server { listen 80; server_name example.ltd; root /srv/example.ltd/www; index index.php; access_log /srv/example.ltd/logs/nginx-main.log main; ...
2
votes
3answers
1k views

Setting up a chroot sftp on debian server

I'm trying to allow a user "user" to access my server by either sftp or ssh. I want to jail them into a directory with chroot. I read the instructions here however it does not work. I did the ...
2
votes
3answers
5k views

ubuntu bind9 AppArmor read permission denied (chroot jail)

I am trying to run bind9 with chroot jail. I followed the steps mentioned at : http://www.howtoforge.com/debian_bind9_master_slave_system I am getting the following errors in my syslog: Jul 27 16:53:...
2
votes
1answer
1k views

How to run easy_install and pip without root, without virtualenv?

People have access to servers as normal users (jailed actually), and they're advised - at the moment - to download whatever python packages they need, setup.py build them, then add their location to ...
2
votes
2answers
1k views

Setup secure shared hosting (Apache, PHP, MySQL)

So I'm setting up a shared hosting with Apache, PHP, MySQL and the biggest question mark is how to do with PHP, since there is a million options out there how to configure it securely. The plan is: ...
2
votes
2answers
268 views

Security of chroot and linux binaries

I'd like to verify the security of chroot and default programs in a linux distribution (say Ubuntu). Example: I set up jail directory 'A'. Every linux binary from the distribution is placed in 'A' ...
2
votes
1answer
403 views

Updating (and configuring) chroots on general purpose CentOS webserver with yum?

I'm currently providing web hosting on a shared web hosting VPS environment - that has no chroot. This is obviously a big security concern, although I've made sure that only the owners of files can ...
2
votes
1answer
1k views

Is there an available repository to update OpenSSH to 4.8+ on Centos 5.4?

I need OpenSSH 4.8+ in order to do setup a clean chrooted SFTP on my Centos 5.4 with Remi and EPEL repositories. Is there a repository for Centos which contain an updated OpenSSH? Thanks! Extra ...
2
votes
1answer
59 views

Error using dnssec-signzone in chroot'd bind 9.8 when a zone file includes other files

Using bind 9.8.2 on RHEL 6.5, running chroot'd. I have a zone file that includes other files (it's a zone with a large number of servers in different datacenters, and there's one included file per ...
2
votes
3answers
3k views

vsftpd: refusing to run with writable root inside chroot

I want to setup a anonymous only ftp server (able to upload files). Here is my config file: listen=YES anonymous_enable=YES anon_root=/var/www/ftp local_enable=YES write_enable=YESr. ...
2
votes
2answers
323 views

can not run java inside grsec chroot

java runs well inside common chroot. however in a grsec hardened chroot it complains it has no enough memory to build VM. any ideas of how to make it run cause i really need a hardened chroot. ...
2
votes
2answers
71 views

Jail on a http only server

Does it make sense to set up a chroot jail for a apache server which is the only service on the server? Or it is pointless, because the server is in either way lost if it get hacked?
1
vote
2answers
2k views

When is it not worth putting Apache in a chroot jail?

I don't mean to question the well established security precaution of putting apache in a chroot-jail in most scenarios but in my scenario I have doubts. We have a virtual server hosting a single ...
1
vote
3answers
3k views

SFTP to chroot and SSH to manage system in one config?

We have a webserver where users are allowed to upload (SFTP) large files in a chroot environment. We also want to be able to use SSH to manage this server. In our old situation we used the system ...
1
vote
2answers
244 views

Easiest way to keep users in their home directory on a web server

I was wondering what would be the easiest and most secured way on a web server to prevent users from browsing directories other than their home folder. I have a mutualised web server with several ...