Questions tagged [chroot]

A chroot on Unix operating systems is an operation that changes the apparent root directory for the current running process and its children.

Filter by
Sorted by
Tagged with
20 votes
5 answers
22k views

How can I chroot ssh connections?

I would like to setup a chroot jail for most (not all) users logging in though SSH. I've heard it's possible with the latest versions of openssh, but I've not been able to find out how to do it. The ...
Malfist's user avatar
  • 807
83 votes
5 answers
255k views

bad ownership or modes for chroot directory component

I created the user MY_USER. Set his home dir to /var/www/RESTRICTED_DIR, which is the path he should be restricted to. Then I edited sshd_config and set: Match user MY_USER ChrootDirectory /var/www/...
MultiformeIngegno's user avatar
7 votes
1 answer
10k views

SFTP user can't edit or create files

Server: Ubuntu 12.04 LTS I am using openSSH and have created an SFTP user called bob who belongs to group sftponly. I have chrooted bob to his home directory which is /usr/share/nginx/www/bob/. bob ...
George Reith's user avatar
16 votes
2 answers
29k views

vsftp: why is allow_writeable_chroot=YES a bad idea?

There are several thousand blog posts about vsftp and allow_writeable_chroot=YES The common error message: Fixing 500 OOPS: vsftpd: refusing to run with writable root inside chroot () I solved ...
guettli's user avatar
  • 3,803
5 votes
1 answer
14k views

Configuring Chroot for SFTP Users

I am trying to configure a SFTP server for some automated backups. I configured an Ubuntu 14.04 server and have had partial success. The idea I'm looking to do is this: A user will be created for ...
imlepid's user avatar
  • 175
3 votes
1 answer
39k views

SSH Fails, /bin/bash: No such file or directory

I have a user who is jailed. sshd_config: Subsystem sftp internal-sftp Match user matt ChrootDirectory %h X11Forwarding no AllowTcpForwarding no passwd: matt:x:1001:5006:Matt Ryan,,...
Matt Ryan's user avatar
  • 175
2 votes
3 answers
1k views

bind9 in a chroot jail - necessary or not?

I always used to keep my bind9 installation in a chroot jail. Now I upgraded my vServer and have to install bind9 over again. Due to the virtualization solution my hosting provider uses, I cannot ...
Danilo Bargen's user avatar
30 votes
6 answers
35k views

Is there a windows equivalent to chroot?

On a *nix system I can use a chroot to isolate two processes from each other and from the rest of the system. Is there any similar security system under windows? Or is there any way to prevent two ...
Rook's user avatar
  • 2,695
14 votes
6 answers
18k views

Trying to setup chroot'd rsync

I'm trying to set up a backup server. I want to chroot each user (client) to its home directory, and only allow it to use sftp and rsync. I quickly discovered that I was not the only one trying to do ...
Mark R.'s user avatar
  • 141
14 votes
1 answer
26k views

PHP-FPM's chroot and chdir directory

I am setting up php-fpm with chrooting enabled. Now I see that there are two options, and I want to know what the exact difference is. The setup has: chroot = /var/www/domains/domain.tld/ ; Chdir to ...
Saif Bechan's user avatar
11 votes
3 answers
26k views

Chroot SFTP - Possible to allow user to write to current (chroot) directory

I currently have a WORKING SFTP login, using a private key for login and the user is chroot'ed into their home directory. Goal: Keep the user chroot but allow WRITE access to the relative chroot ...
emmdee's user avatar
  • 2,267
8 votes
3 answers
25k views

"500 OOPS: vsftpd: refusing to run with writable root inside chroot()" - login failed on Debian

I installed vsFTPd for running an FTP server on Debian 7.3 (Wheezy). I checked the vsFTPd version was 2.3.5, and I configured it like so: listen=YES local_enable=YES write_enable=YES ...
shgnInc's user avatar
  • 1,884
7 votes
1 answer
22k views

SFTP: log to a separate file for chrooted user

I would like to log SFTP commands to a separate file however it works only for root but not for chrooted user: # cat /etc/ssh/sshd_config ... Subsystem sftp internal-sftp -l INFO Match Group ...
HTF's user avatar
  • 3,188
7 votes
2 answers
7k views

SFTP suddenly failing for chroot accounts on Amazon Linux

Frustratingly, SFTP users suddenly stopped being able to connect to my Amazon Linux server. The /var/log/secure shows the following error: sshd[7291]: fatal: safely_chroot: stat("/chroot/uhleeka"):...
uhleeka's user avatar
  • 173
4 votes
3 answers
3k views

set up a chrooted SFTP login with OpenSSH

How might I create an SFTP login for an untrusted user in which he can only access the files in his own home directory and not run any commands? The online tutorial OpenSSH SFTP chroot() with ...
Sophie Alpert's user avatar
0 votes
1 answer
4k views

Apache + PHP-FPM + chroot results "File not found." error

I want to set chroot to the DocumentRoot using PHP-FPM pools' chroot attribute. With the settings below, whatever I do I get only a "File not found." error: /etc/php5/fpm/pool.d/example.conf [...
user171447's user avatar
24 votes
6 answers
31k views

Ubuntu - can non-root user run process in chroot jail?

Is it possible for a non-root user to run a chroot process on Ubuntu?
Hawkeye's user avatar
  • 2,739
22 votes
6 answers
22k views

OpenSSH anything like 'internal-sftp' but for SCP?

I'm running Debian stable and I'm looking to establish the following environment for users in my 'sftponly' group: jailed can transfer with SFTP can transfer with SCP cannot login interactively with ...
brianjcohen's user avatar
15 votes
3 answers
8k views

Why chroot is considered insecure?

I've been playing around with CentOS box for couple of years now. So I'm pretty comfy with terminal. However, I read a lot of blog-post claiming that chroot is insecure and amount of those posts ...
Aleksandr Makov's user avatar
14 votes
2 answers
59k views

SFTP fatal bad ownership or modes for chroot directory ubuntu 12.04

I just set up my SFTP server and it works fine when I use it from my first user account. I wanted to add a user which we will call 'magnarp'. At first I did like this in sshd_config: Subsystem sftp ...
Jonathan's user avatar
  • 143
12 votes
4 answers
12k views

Why running named(bind) in chroot is so important for security? Or maybe it is not?

I'm playing with bind and started wondering why this software is, for example, in CentOS running in chroot. Don't misunderstand me, I know what bind is and what chroot (jail) is for. But my main ...
B14D3's user avatar
  • 5,258
10 votes
3 answers
3k views

RedHat: is it possible to install packages in a kind of mock environment to build RPMs

Is there a tool that allows to install the dependecies of an RPM .spec into an isolated environment? I won't install such dependencies globally on the system and I am not able to do so since I have ...
try-catch-finally's user avatar
6 votes
1 answer
9k views

sftp server chroot initial directory

I have configured an sftp server with chroot and it works fine, the only thing that is bothering me is the initial landing directory, since the sftp user does not have write permissions in the landing ...
Carles Estevadeordal's user avatar
5 votes
3 answers
17k views

yum/rpm Failed to initialize NSS library in chroot

I am performing a yum update from CentOS 7.4 to CentOS 7.5, when nspr and nss soft-softoken receive the updates, I am left with the following error: yum update nspr error: Failed to initialize NSS ...
Arlion's user avatar
  • 628
5 votes
3 answers
3k views

postfix/smtp: fatal: unknown service: smtp/tcp – but /var/spool/postfix/etc/services exists

I am running a Debian GNU/Linux 8.7 box with Postfix 2.11.3-1 as MTA. All of a sudden, that is, with no change to the MTA setup, mails stopped being delivered, and the following error started showing ...
Odin Kroeger's user avatar
5 votes
2 answers
2k views

What is the secure way to isolate ftp server users on unix?

I've read documentation for various ftp daemons and various long threads about the security implications of using a chroot environment for an ftp server when giving users write access. If you read the ...
djs's user avatar
  • 200
4 votes
1 answer
16k views

A proper way to create a chrooted SSH on CentOS 7 [closed]

There are a lot of tutorials of how to create a chrooted SFTP, but I would like to use SSH, because it is much faster to simply wget, unzip, mysql and mysqldump than tossing around the FTP and ...
amq's user avatar
  • 743
4 votes
3 answers
20k views

ubuntu bind9 AppArmor read permission denied (chroot jail)

I am trying to run bind9 with chroot jail. I followed the steps mentioned at : http://www.howtoforge.com/debian_bind9_master_slave_system I am getting the following errors in my syslog: Jul 27 16:53:...
Richard Whitman's user avatar
4 votes
2 answers
4k views

update grub2 without hardware access (e.g. in a chroot)?

I'm writing a script that takes a master KVM image, converts it to VDI, makes a few changes to it, and offers it up for download. I need to update the kernel boot parameters for some of the newly ...
wryfi's user avatar
  • 161
3 votes
2 answers
10k views

permission denied on authorized_keys

I am attempting to set up SFTP for chrooted users, and use SSH public key authentication. In this example I'll be working with the dummy user "globocorp" who's a member of "sftpusers". This user is ...
esoterydactyl's user avatar
3 votes
1 answer
2k views

Increasing permissiveness/permissions for umask + openssh + chrooted SFTP server using internal-sftp

The suggestion found at these links works for me: How to setup ssh's umask for all type of connections http://ubuntuforums.org/showthread.php?t=1107974#5 Summary: Use PAM to inject the umask, ...
JDS's user avatar
  • 2,608
3 votes
3 answers
6k views

How to chroot Apache on CentOS?

I have been advised by a sysadmin, to run Apache in a chroot jail, in order to prevent that an attacker could take control of server. So my question is: What is the best method to chroot Apache/2.2....
Jonathan Meyer's user avatar
3 votes
1 answer
5k views

chroot, gpg-agent, and Ubuntu 18.04

For SFTP access to my server, I have created a sftp user that is limited to a working directory by chroot. Match User sftp-user AuthorizedKeysFile /home/sftp-user/.ssh/authorized_keys ...
BurninLeo's user avatar
  • 910
3 votes
2 answers
225 views

How to create a link outside of the jail, but accessable within the jail?

I have created a chroot jail, but now I want to be able to create a link within the jail which links outside of the jail. Is this possible?
samwell's user avatar
  • 339
2 votes
2 answers
23k views

How to run tomcat6 on ubuntu as root?

I've got an existing software package that runs on Ubuntu that uses a chroot jail and so needs to be run as root. I want to exec this from a java web application running within Tomcat6 on Ubuntu, so ...
Hawkeye's user avatar
  • 2,739
2 votes
2 answers
12k views

Pure-FTPD chroot not working on a fresh Debian install?

I am trying to get chroot to work with virtual Pure-FTPD users, but for some reason it simply is not working. I changed the following options: /etc/default/pure-ftpd-common: VIRTUALCHROOT=true /...
Aron Rotteveel's user avatar
2 votes
1 answer
8k views

Is it possible to allow key based authentication for sshd_config chroot sftp users?

I'm running an Ubuntu 12.04.1 LTS (GNU/Linux 3.2.0-30-generic x86_64) Server, with OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012. I'd like to configure chroot for sftp access using ...
Ted LeRoy's user avatar
1 vote
1 answer
646 views

Chrooting a ftp user to a particular directory

I would like to chroot a user to their home directory on a debian linux server. Im using vsftpd server. I've done it with a user before, and now cant remember how to do it. I've limited ssh access to ...
madphp's user avatar
  • 379
1 vote
1 answer
3k views

How to specify user home in sshd config?

I have my sftp users chrooted into /var/www and I would like for them to be automatically moved into their directory. I found this answer which helped me a lot: Chroot SFTP - Possible to allow user to ...
leonheess's user avatar
  • 144
1 vote
2 answers
367 views

SFTP Chroot Ubuntu 10.10

I'm trying to give an SFTP only access to his home directory to a user. This is the /etc/passwd line for the user: bob:x:1003:1003::/home/bob:/bin/false I edited the /etc/ssh/sshd_config file like ...
bicccio's user avatar
  • 111
1 vote
1 answer
2k views

Is it possible to run dhcpd3 as non-root user in a chroot jail?

I would like to run dhcpd3 from a chroot jail on Debian Lenny. At the moment, I can run it as root from my jail. Now I want to do this as non-root user (as "-u blah -t /path/to/jail" Bind option). ...
Lenain's user avatar
  • 11
1 vote
3 answers
2k views

sftp chrooted dosent work with some sftp client (Cyberduck)

I'm not able working on SFTP+chrooted env Using internal-sftp directive it works, but i'm not able to set umask. (ex umask 002) Using sftp-server from openssh package dosent't work because login shell ...
emaaaa's user avatar
  • 23
1 vote
4 answers
2k views

Restrict users to their home directory

How do I restrict the user to his current directory only? I tried the steps mentioned on this page to configure rssh chroot jail to lock users to their home directories only, but this looks too ...
shantanuo's user avatar
  • 3,619
1 vote
2 answers
3k views

Trying to ChrootDirectory an SFTP user to their home directory

I have followed a few examples of how to do this, all of them end up with modifying sshd_config to Subsystem sftp internal-sftp Match User chubbyninja ChrootDirectory %h AllowTCPForwarding ...
CᴴᵁᴮᴮʸNᴵᴺᴶᴬ's user avatar
1 vote
2 answers
5k views

sftp chroot access via SSH

I have this setup in sshd_config: AllowUsers test1 test2 Match group sftpgroup ChrootDirectory /var/www X11Forwarding no AllowTcpForwarding no ForceCommand ...
Cudos's user avatar
  • 539
0 votes
1 answer
178 views

Chroot seems to be missing some progs/libs. What's necessary to get default commandline behaviour?

I've set up a chrooted environment using this tutorial. But the commandline isn't displayed correctly. Instead of the usual user@hostname:/home/user# it displays -bash-4.1$. What programs are needed ...
Stuffy's user avatar
  • 177
0 votes
1 answer
2k views

Set Users as chrooted for sftp, but allow user to login in SSH

I have setup a ssh server on debian 7, to use sftp connection. I chrooted some user, with this config: Match Group sftpusers ChrootDirectory /sftp/%u ForceCommand internal-sftp But if i ...
Eghes's user avatar
  • 89
0 votes
3 answers
773 views

Restricting SSH shell access to Debian server

Still new to the whole Debian thing so bear with me. The only thing I want a user logged in via SSH. No files or directories (like /etc, /var) should be visible at that point. The only thing the ...
Cudos's user avatar
  • 539
0 votes
3 answers
318 views

FTP server configuration

I am configuring VsFTPd 2.2.2 server on Debian 5.0. I want user after login can see and edit just two dirs: /home/user/ /var/www/project1/ /var/www/project2/ Possible solutions I can Chroot user ...
user avatar
0 votes
1 answer
772 views

Permissions on chrooted user not working after update on Amazon Linux

I setup chrooted users on an Amazon Linux development instance to grant them access to the /var/www folder. It was working fine, but after a yum update (November I think), the users can no longer ...
Complectia's user avatar