A chroot on Unix operating systems is an operation that changes the apparent root directory for the current running process and its children.

learn more… | top users | synonyms (1)

18
votes
5answers
13k views

How can I chroot ssh connections?

I would like to setup a chroot jail for most (not all) users logging in though SSH. I've heard it's possible with the latest versions of openssh, but I've not been able to find out how to do it. The ...
14
votes
2answers
31k views

bad ownership or modes for chroot directory component

I created the user MY_USER. Set his home dir to /var/www/RESTRICTED_DIR, which is the path he should be restricted to. Then I edited sshd_config and set: Match user MY_USER ChrootDirectory ...
12
votes
2answers
40k views

chroot fails - cannot run command `/bin/bash': No such file or directory

I'm a chroot novice trying to make a simple chroot jail but am banging my head against the same problem time and time again... Any help would be massively appreciated I've created a directory ...
12
votes
1answer
12k views

SFTP: file symlinks in a jailed (chrooted) directory

I'm trying to set up sftp so that a few trusted people can access/edit/create some files. I have jailed a user into their home directory (/home/name) but have run into a problem. I want for them to ...
12
votes
4answers
11k views

Is there a windows equivalent to chroot?

On a *nix system I can use a chroot to isolate two processes from each other and from the rest of the system. Is there any similar security system under windows? Or is there any way to prevent two ...
11
votes
4answers
3k views

Why running named(bind) in chroot is so important for security? Or maybe it is not ?

I'm playing with bind and started wondering why this software is for example in CentOS running in chroot. Don't misunderstood me I know what bind is and what chroot (jail) is for. But my main wonder ...
11
votes
4answers
9k views

OpenSSH anything like 'internal-sftp' but for SCP?

I'm running Debian stable and I'm looking to establish the following environment for users in my 'sftponly' group: jailed can transfer with SFTP can transfer with SCP cannot login interactively with ...
10
votes
3answers
1k views

RedHat: is it possible to install packages in a kind of mock environment to build RPMs

Is there a tool that allows to install the dependecies of an RPM .spec into an isolated environment? I won't install such dependencies globally on the system and I am not able to do so since I have ...
9
votes
4answers
2k views

When is it appropriate / prudent to use chroot?

I hear about needing to chroot BIND all the time. Fair enough. But what about other programs? What are the "rules" (either personal or widely accepted/established) for deciding which programs ...
9
votes
5answers
8k views

Ubuntu - can non-root user run process in chroot jail?

Is it possible for a non-root user to run a chroot process on Ubuntu?
9
votes
2answers
18k views

SFTP fatal bad ownership or modes for chroot directory ubuntu 12.04

I just set up my SFTP server and it works fine when I use it from my first user account. I wanted to add a user which we will call 'magnarp'. At first I did like this in sshd_config: Subsystem sftp ...
7
votes
1answer
5k views

Why use lxc instead of chroot?

One ubuntu server hosts 3 apps all on separate domains. Each app has its own developers. App developers belong to linux "sftp" group. chroot allows password sftp access for each app developer. ...
7
votes
2answers
1k views

Why chroot is considered insecure?

I've been playing around with CentOS box for couple of years now. So I'm pretty comfy with terminal. However, I read a lot of blog-post claiming that chroot is insecure and amount of those posts ...
7
votes
1answer
710 views

Why is chroot system call not available to non root user?

I was reading description about setuid on wikipedia http://en.wikipedia.org/wiki/Setuid I was unable to understand how chroot is related to setuid as mention in following paragraph from wikipedia ...
6
votes
3answers
7k views

Trying to setup chroot'd rsync

I'm trying to set up a backup server. I want to chroot each user (client) to its home directory, and only allow it to use sftp and rsync. I quickly discovered that I was not the only one trying to do ...
6
votes
1answer
5k views

Trying to set up SFTP only in a chroot jail for one user

Hopefully you guys can help and see if I've done something weird here, I'm trying to log in with a user I set up, FileZilla shows me: Command: open "///@///" Command: Pass: ******** Status: ...
6
votes
1answer
6k views

PHP-FPM's chroot and chdir directory

I am setting up php-fpm with chrooting enabled. Now I see that there are two options, and I want to know what the exact difference is. The setup has: chroot = /var/www/domains/domain.tld/ ; Chdir to ...
6
votes
4answers
3k views

Difference between chroot and jail

I read this tutorial - https://help.ubuntu.com/community/BasicChroot - and what I understood is that, chroot is the process of changing the / while the new restricted environment created is the ...
5
votes
4answers
983 views

Is there a chroot build script somewhere?

I am about to develop a little script to gather information for a chroot-jail. In my case this looks (at the first glance) pretty simple: The application has a clean rpm-install and did install ...
4
votes
3answers
8k views

Why is “chroot” never used on Mac OS X?

I've been using Macs for 25 years, and "UNIX" since OS X 10.0.. but I've never really thought much about chroot, nor have I ever really needed or wanted to... It's a simple question, but... under ...
4
votes
7answers
1k views

Does using chroot for a publicly-exposed service provide any real security benefit?

I would like a definitive answer as to why this practice should be pursued with services that are exposed to potentially hostile network(s) (i.e. the Internet). As I understand it, there is a method ...
4
votes
1answer
8k views

VSFTPD - Change User Home Directory

I need to update a ftp user's home directory. Could I run the userdel command then re-add the user without losing the directory the user was attached to? Or is there another way to change the user's ...
4
votes
2answers
2k views

schroot fails to mount on entry

I'm trying to setup a chroot environment for myself, and it is failing. This has been reproduced on multiple versions (10.04 and 11.04) of Ubuntu. I set it up by doing: $ mkdir -p ...
4
votes
3answers
2k views

set up a chrooted SFTP login with OpenSSH

How might I create an SFTP login for an untrusted user in which he can only access the files in his own home directory and not run any commands? The online tutorial OpenSSH SFTP chroot() with ...
4
votes
2answers
1k views

update grub2 without hardware access (e.g. in a chroot)?

I'm writing a script that takes a master KVM image, converts it to VDI, makes a few changes to it, and offers it up for download. I need to update the kernel boot parameters for some of the newly ...
4
votes
2answers
8k views

How do I unmount a bound /proc in a “dead” chroot?

I built a debootstrap chroot and bound /proc to it, i.e. sudo mount -o bind /proc <chroot>/proc When I found I no longer needed it, I quite stupidly rm -r <chroot>'d it. Of course, rm ...
4
votes
0answers
742 views

Can socat be used to forward an ssh-agent socket into a chroot?

I'm building custom Debian environments on a remote server, which I connect to over SSH. This involves building a debootstrap environment, then chrooting into it to run a custom installer. As part of ...
4
votes
2answers
2k views

What is the secure way to isolate ftp server users on unix?

I've read documentation for various ftp daemons and various long threads about the security implications of using a chroot environment for an ftp server when giving users write access. If you read the ...
3
votes
4answers
8k views

Unmounting root filesystem without rebooting the server

I have a server that I can access through SSH. There is no KVM available and there's only one root partition for the whole server. I have deleted some files that I shouldn't have and want to recover ...
3
votes
2answers
126 views

How to create a link outside of the jail, but accessable within the jail?

I have created a chroot jail, but now I want to be able to create a link within the jail which links outside of the jail. Is this possible?
3
votes
3answers
6k views

chrooting php-fpm with nginx

I'm setting up a new server with PHP 5.3.9 and nginx, so I compiled PHP with the php-fpm SAPI options. By itself it works great using the following server entry in nginx: server { listen 80; ...
3
votes
2answers
2k views

Setup PHP/MYSQL for chrooted jail (jailkit)

I'm running Ubuntu, with PHP5-FPM, mysql & Nginx I've just setup a chrooted jail with jailkit. Now I need to work out how to setup my php and mysql to work within the jail. Google search doesn't ...
3
votes
1answer
9k views

500 OOPS: vsftpd: refusing to run with writable root inside chroot() Login failed on debian

I install vsftpd for running FTP server on debian 7.3. I checked vsftpd version was 2.3.5 and i configure it like so: listen=YES local_enable=YES write_enable=YES chroot_local_user=YES ...
3
votes
1answer
2k views

SFTP user can't edit or create files

Server: Ubuntu 12.04 LTS I am using openSSH and have created an SFTP user called bob who belongs to group sftponly. I have chrooted bob to his home directory which is /usr/share/nginx/www/bob/. bob ...
3
votes
2answers
10k views

chrooting user causes “connection closed” message when using sftp

First off I am a linux newbie so please don't assume much knowledge. I am using CentOS 5.8 (final) and using OpenSSH version 5.8p1. I have made a user playwithbits and I am attempting to chroot them ...
3
votes
4answers
5k views

Prevent rssh users from leaving their jail directories

I'm attempting to use rssh to jail users strictly to their /home/user/public_html dirctories. I got it to work where an account can SFTP into the system successfully on a test server, but once I login ...
3
votes
1answer
182 views

Should Postfix run chrooted if it already is in it a FreeBSD jail?

I'm running Postfix together with Dovecot and a few milters in a FreeBSD jail. Is there a significant security gain when I run SMTP and SMTPD daemons chrooted as well?
3
votes
2answers
1k views

How to map authenticated Nginx users to their own directory?

I am writing a social networking site in C and serving it all up with Nginx. How can I make it so that authenticated users go to their own directory -ONLY- where a user-specific index.html resides. ...
3
votes
1answer
1k views

Jail User to /var/www/username Directory via SSH

I have multiple folders in /var/www for different websites -- Apache uses name-based Virtual Hosts (Ubuntu Server). Suppose I want to allow someone to access their /var/www/user directory, but not cd ...
3
votes
3answers
2k views

Good resource for chrooting Apache2 on Debian

I need a better resource than this or this on how to secure Apache2 using chroot on a Debian system. It seems most articles deal with Apache1. I tried to follow them and adapt to Apache2, but it only ...
3
votes
1answer
502 views

build user chroot on first login

I'm using ldap for remote user authentication and I basically need to either figure out how to: a. chroot a user on machine b from machine a via nfs,(which doesn't seem possible without mounting ...
3
votes
1answer
327 views

Link all LXC node APT caches to the host machine's APT cache

I have a number of LXC containers (ubuntu template) which all have their own separate APT caches. /var/lib/lxc/*/rootfs/var/cache/apt/archives/ I would like to have these linked to the host ...
3
votes
1answer
2k views

Jailkit not allowing SSH connections

I'm trying to set up jailkit on one of my servers which is running Debian 5. I created a new ssh user (bob) and a chroot directory for him (/var/www/bob). I gave the chroot the extshellplusnet and ...
3
votes
3answers
4k views

How to chroot Apache on CentOS?

I have been advised by a sysadmin, to run Apache in a chroot jail, in order to prevent that an attacker could take control of server. So my question is: What is the best method to chroot ...
3
votes
1answer
125 views

vsftp: why is allow_writeable_chroot=YES a bad idea?

There are several thousand blog posts about vsftp and allow_writeable_chroot=YES The common error message: Fixing 500 OOPS: vsftpd: refusing to run with writable root inside chroot () I solved ...
3
votes
1answer
2k views

VSFTPD how chroot not chrooted users in /home?

I need to chroot all local users to their home directories, but one user should have access to all user directories. If I put admin_user in chroot_list_file he has access for whole file system. I want ...
3
votes
1answer
187 views

using /bin/bash in a chroot environment - symlink or mount

A user connects via ssh. The user is also chroot-ed to their home directory. The goal is security. Since the user is chroot-ed, when they login /bin/bash is not found. Obviously the user needs ...
3
votes
1answer
10k views

SFTP: log to a separate file for chrooted user

I would like to log SFTP commands to a separate file however it works only for root but not for chrooted user: # cat /etc/ssh/sshd_config ... Subsystem sftp internal-sftp -l INFO Match Group ...
3
votes
1answer
665 views

Resource consumption of FreeBSD's jails

Just for curiosity. An example machine: an dedicated amd64 server with the last stable version of FreeBSD and UFS for the partitions. How much resources consume FreeBSD for each empty jail? I mean, I ...
3
votes
1answer
766 views

jailkit chroot terminates ssh login

I've done my very best to follow these instructions to create a chroot shell. But the connection get's terminated every time I try to login via ssh for my new chrooted user. I start my ssh terminal, ...