A chroot on Unix operating systems is an operation that changes the apparent root directory for the current running process and its children.

learn more… | top users | synonyms

1
vote
1answer
1k views

HAProxy running in chroot jail is only logging started messages

I've configured my HAProxy server to run in a chroot jail logging messages to syslog socket. My problem is that the only messsages currently being logged are for when haproxy is starting up. May 26 ...
0
votes
1answer
396 views

vsftpd chroot_local_user error

When I set chroot_local_user to YES in the vsftpd configuration, I get this error in my ftp client: 220: (vsFTPd 2.3.5) Connected to 23.21.50.255. Cmd: AUTH TLS 234: Proceed with negotiation. Cmd: ...
0
votes
1answer
496 views

Do I need to chroot BIND 9 if I'm using AppArmor? [duplicate]

Possible Duplicate: bind9 in a chroot jail - necessary or not? I'm redoing my external dns servers and thinking about skipping chroot this time. And using apparmor or selinux as an ...
0
votes
1answer
395 views

Chroot SFTP Users

I have an Ubuntu Server, where several users log in to upload some files. Each user has a home directory, in which I 'd like to be chrooted. e.g. user1 connects with sftp to the server and is ...
1
vote
1answer
59 views

chrooting an application

I have an requirement that requires all applications running on a server in a DMZ to be chrooted. How does one chroot an application using Ubuntu? Are there any good online guides?
1
vote
1answer
371 views

is doing mount -t proc none /proc unsecure for a chroot environment?

What does mount -t proc none /proc do inside the chrooted environment? After doing that, when I run htop or ps aux inside the chrooted environment, I can see the actual root's processes. Does it ...
2
votes
3answers
960 views

Defining hard links in puppet

Is there a way to define hardlinks inside puppet manifest? It seems file type can only define symbolic links, but I need it to be hard links in order to make some of my chrooted applications to work. ...
2
votes
3answers
5k views

chrooting php-fpm with nginx

I'm setting up a new server with PHP 5.3.9 and nginx, so I compiled PHP with the php-fpm SAPI options. By itself it works great using the following server entry in nginx: server { listen 80; ...
3
votes
2answers
124 views

How to create a link outside of the jail, but accessable within the jail?

I have created a chroot jail, but now I want to be able to create a link within the jail which links outside of the jail. Is this possible?
1
vote
1answer
977 views

setlocale error with chroot

I have created a chroot jail and when I log in I get a bash warning bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8) I tried to google the error, but wasn't able to find a ...
1
vote
2answers
1k views

Implications that come with chrooting php-fpm

I am creating a production server that will run nginx with php-fpm. I want to have a good mix between securing the server, and still having good quick workflow. Now one thing that always secures the ...
5
votes
1answer
5k views

PHP-FPM's chroot and chdir directory

I am setting up php-fpm with chrooting enabled. Now I see that there are two options, and I want to know what the exact difference is. The setup has: chroot = /var/www/domains/domain.tld/ ; Chdir to ...
2
votes
4answers
4k views

Prevent rssh users from leaving their jail directories

I'm attempting to use rssh to jail users strictly to their /home/user/public_html dirctories. I got it to work where an account can SFTP into the system successfully on a test server, but once I login ...
1
vote
1answer
549 views

Executing command inside a chroot from an apache/php script

I need to unit test some bash scripts, I have setup a debian squeeze in a chroot. From command line I can use chroot /directory my-command, ou schroot -d / -u root my-command, but I need to run ...
0
votes
1answer
1k views

Chroot jail of Nginx and php

I'm hosting multiple websites on one VPS, and want to chroot each website, eg. /chroot/website1 /chroot/website2 I'm using makejail, which is a highlevel tool, for creating the jails, and copying the ...
0
votes
2answers
580 views

How to disable PHP's ini_set for specific configuration options?

I'm running a setup with PHP 5.3.8 and use php-fpm with it's chroot functionality to separate multiple customers. So each customer has it's own chrooted PHP-environment, which is quite fine. I now ...
0
votes
2answers
131 views

Support needed creating Dovecot listener on Debian ( postfix)

I would like to create a dovecot lmtp listener under /var/spool/postfix/private/. Because postfix runs chrooted by default under debian. How can I do this? Grtz
2
votes
2answers
1k views

Setup secure shared hosting (Apache, PHP, MySQL)

So I'm setting up a shared hosting with Apache, PHP, MySQL and the biggest question mark is how to do with PHP, since there is a million options out there how to configure it securely. The plan is: ...
3
votes
1answer
1k views

Jail User to /var/www/username Directory via SSH

I have multiple folders in /var/www for different websites -- Apache uses name-based Virtual Hosts (Ubuntu Server). Suppose I want to allow someone to access their /var/www/user directory, but not cd ...
1
vote
1answer
137 views

How can I set a global sftp chroot for a group (or all) users on a server [duplicate]

Possible Duplicate: set up a chrooted SFTP login with OpenSSH I am not familiar with chroot jails so please forgive my ignorance. From my understanding you would normally chroot a user to ...
0
votes
1answer
1k views

Chroot In .bashrc For User; Operation Not Permitted

I am trying to chroot a user when they login with ssh. So, what I did is added the following line to their .bashrc file: chroot /apps/web When I login with the user though, I am getting: chroot: ...
0
votes
1answer
180 views

How To Create Users Who Are Chrooted At A Directory

Is it possible to have users on linux, who's home directory is still the default /home/joe but when they login via ssh/sftp, they are chroot at /apps/web/? Basically I wanted to keep all users files ...
2
votes
3answers
684 views

bind9 in a chroot jail - necessary or not?

I always used to keep my bind9 installation in a chroot jail. Now I upgraded my vServer and have to install bind9 over again. Due to the virtualization solution my hosting provider uses, I cannot ...
4
votes
1answer
8k views

VSFTPD - Change User Home Directory

I need to update a ftp user's home directory. Could I run the userdel command then re-add the user without losing the directory the user was attached to? Or is there another way to change the user's ...
3
votes
4answers
5k views

Unmounting root filesystem without rebooting the server

I have a server that I can access through SSH. There is no KVM available and there's only one root partition for the whole server. I have deleted some files that I shouldn't have and want to recover ...
1
vote
2answers
369 views

Secure PHP environments with PHP-FPM and SFTP

I'd like to set up secure environments for a small number of untrusted PHP websites on a Debian server. Right now everything runs on the same Apache2 with mod_php5 and vsftpd for administrative file ...
4
votes
2answers
2k views

schroot fails to mount on entry

I'm trying to setup a chroot environment for myself, and it is failing. This has been reproduced on multiple versions (10.04 and 11.04) of Ubuntu. I set it up by doing: $ mkdir -p ...
0
votes
1answer
1k views

Share multiple directories to ftp users

I have multiple directories spread over the file systems of multiple Ubuntu 10.04 servers. The requirements are to allow a handful of people access a few of these directories over ftp. For example ...
0
votes
1answer
131 views

Jail CentOS group to single dir (and dir's within) - FTP

What I am ultimately looking to do is jail a group of users to only be able to FTP into their home folder. They should be able to have r&w capabilities within their home folder, and within ALL ...
3
votes
1answer
1k views

Increasing permissiveness/permissions for umask + openssh + chrooted SFTP server using internal-sftp

The suggestion found at these links works for me: How to setup ssh's umask for all type of connections http://ubuntuforums.org/showthread.php?t=1107974#5 Summary: Use PAM to inject the umask, ...
5
votes
3answers
6k views

Trying to setup chroot'd rsync

I'm trying to set up a backup server. I want to chroot each user (client) to its home directory, and only allow it to use sftp and rsync. I quickly discovered that I was not the only one trying to do ...
1
vote
4answers
994 views

Restrict users to their home directory

How do I restrict the user to his current directory only? I tried the steps mentioned on this page to configure rssh chroot jail to lock users to their home directories only, but this looks too ...
1
vote
2answers
1k views

When is it not worth putting Apache in a chroot jail?

I don't mean to question the well established security precaution of putting apache in a chroot-jail in most scenarios but in my scenario I have doubts. We have a virtual server hosting a single ...
0
votes
1answer
362 views

How to create virtual users in vsftpd?

I am running vsftpd on my Debian squeeze server. I configured it to chroot local users into their /home/ directory. Now, the problem is that users' web pages are outside of their /home/ directories ...
2
votes
1answer
899 views

Debian: ip/network changes within chroot/jail

I've Debian Squeeze running and setup a chroot environment (/jail) with debootstrap. As seen in a tutorial, I mounted the following: proc on /jail/proc type proc (rw) devpts on /jail/dev/pts type ...
2
votes
1answer
260 views

Security implications of mount --bind in a chroot environment

Assume you have a chroot environment where you need a resource - an application or a library - which resides on the host (external to the chroot). Which are the security implications (if any) of ...
1
vote
1answer
498 views

Is there an equivalent of ToLower for a vsftpd.conf?

I am running a vsFTP server using virtual users. I chroot each user to their own personal subdirectory. For ease of use I would like to make my usernames case-insensitive, but I am having some ...
4
votes
3answers
7k views

Why is “chroot” never used on Mac OS X?

I've been using Macs for 25 years, and "UNIX" since OS X 10.0.. but I've never really thought much about chroot, nor have I ever really needed or wanted to... It's a simple question, but... under ...
2
votes
2answers
241 views

Security of chroot and linux binaries

I'd like to verify the security of chroot and default programs in a linux distribution (say Ubuntu). Example: I set up jail directory 'A'. Every linux binary from the distribution is placed in 'A' ...
0
votes
1answer
642 views

How to get PHP mysql_ extension for linux chroot jail?

I've setup a chroot jail using jailkit on my Ubuntu 10.04 system. I've copied the binaries for php and mysql which all worked fine. So from the command line of my chrooted user I can run php ...
1
vote
2answers
4k views

OpenSSH 5.3 setting UMASK for SFTP chroot env, dosen't work at all

I tried to override umask setting on SFTP connection in chrooted env. I couldnt use subsytem diffrente than internal-ftp. In OpenSSH_5.3p1 (Debian-3ubuntu4, OpenSSL 0.9.8k 25 Mar 2009) there's umask ...
1
vote
3answers
1k views

sftp chrooted dosent work with some sftp client (Cyberduck)

I'm not able working on SFTP+chrooted env Using internal-sftp directive it works, but i'm not able to set umask. (ex umask 002) Using sftp-server from openssh package dosent't work because login shell ...
3
votes
1answer
721 views

jailkit chroot terminates ssh login

I've done my very best to follow these instructions to create a chroot shell. But the connection get's terminated every time I try to login via ssh for my new chrooted user. I start my ssh terminal, ...
0
votes
1answer
8k views

SSH Fails, /bin/bash: No such file or directory

I have a user who is jailed. sshd_config: Subsystem sftp internal-sftp Match user matt ChrootDirectory %h X11Forwarding no AllowTcpForwarding no passwd: matt:x:1001:5006:Matt ...
0
votes
1answer
177 views

How can I setup a one-way scp?

I am trying to setup a remote host to act as a data sink, i.e. some kind of environment on the remote host, A, which allows users to scp data from their local machine to A but not from A to their ...
3
votes
3answers
3k views

How to chroot Apache on CentOS?

I have been advised by a sysadmin, to run Apache in a chroot jail, in order to prevent that an attacker could take control of server. So my question is: What is the best method to chroot ...
2
votes
1answer
393 views

Updating (and configuring) chroots on general purpose CentOS webserver with yum?

I'm currently providing web hosting on a shared web hosting VPS environment - that has no chroot. This is obviously a big security concern, although I've made sure that only the owners of files can ...
1
vote
2answers
5k views

Pure-FTPD chroot not working on a fresh Debian install?

I am trying to get chroot to work with virtual Pure-FTPD users, but for some reason it simply is not working. I changed the following options: /etc/default/pure-ftpd-common: VIRTUALCHROOT=true ...
0
votes
1answer
301 views

Multiple chroots in ubuntu for PHP/MySQL hosting

We have a server, Core i7, 24GB RAM we run some of our own applications on. I want to offer some clients PHP/MySQL hosting on that server. Is it feaseable and possible to create a chroot for each ...
0
votes
1answer
465 views

File permissions to run mysqld in chroot

I'm trying to run mysqld inside chroot environment. Herez the situation. When I run mysqld as root, I can connect to my databases. But when I run mysql using init.d scripts, mysql gives me an error. ...