A chroot on Unix operating systems is an operation that changes the apparent root directory for the current running process and its children.
14
votes
5answers
9k views
How can I chroot ssh connections?
I would like to setup a chroot jail for most (not all) users logging in though SSH. I've heard it's possible with the latest versions of openssh, but I've not been able to find out how to do it. The ...
9
votes
3answers
411 views
RedHat: is it possible to install packages in a kind of mock environment to build RPMs
Is there a tool that allows to install the dependecies of an RPM .spec into an isolated environment? I won't install such dependencies globally on the system and I am not able to do so since I have ...
8
votes
4answers
1k views
When is it appropriate / prudent to use chroot?
I hear about needing to chroot BIND all the time. Fair enough. But what about other programs? What are the "rules" (either personal or widely accepted/established) for deciding which programs ...
5
votes
4answers
204 views
Difference between chroot and jail
I read this tutorial - https://help.ubuntu.com/community/BasicChroot - and what I understood is that, chroot is the process of changing the / while the new restricted environment created is the ...
5
votes
5answers
3k views
Ubuntu - can non-root user run process in chroot jail?
Is it possible for a non-root user to run a chroot process on Ubuntu?
5
votes
3answers
4k views
Is there a windows equivalent to chroot?
On a *nix system I can use a chroot to isolate 2 processes from each other and from the rest of the system. Is there any similar security system under windows? Or is there any way to prevent 2 ...
5
votes
4answers
225 views
Is there a chroot build script somewhere?
I am about to develop a little script to gather information for a chroot-jail.
In my case this looks (at the first glance) pretty simple:
The application has a clean rpm-install and did install ...
4
votes
7answers
1k views
Does using chroot for a publicly-exposed service provide any real security benefit?
I would like a definitive answer as to why this practice should be pursued with services that are exposed to potentially hostile network(s) (i.e. the Internet). As I understand it, there is a method ...
4
votes
2answers
18k views
chroot fails - cannot run command `/bin/bash': No such file or directory
I'm a chroot novice trying to make a simple chroot jail but am banging my head against the same problem time and time again... Any help would be massively appreciated
I've created a directory ...
4
votes
2answers
796 views
schroot fails to mount on entry
I'm trying to setup a chroot environment for myself, and it is failing. This has been reproduced on multiple versions (10.04 and 11.04) of Ubuntu. I set it up by doing:
$ mkdir -p ...
3
votes
3answers
4k views
Why is “chroot” never used on Mac OS X?
I've been using Macs for 25 years, and "UNIX" since OS X 10.0.. but I've never really thought much about chroot, nor have I ever really needed or wanted to...
It's a simple question, but... under ...
3
votes
1answer
5k views
VSFTPD - Change User Home Directory
I need to update a ftp user's home directory. Could I run the userdel command then re-add the user without losing the directory the user was attached to? Or is there another way to change the user's ...
3
votes
3answers
2k views
Trying to setup chroot'd rsync
I'm trying to set up a backup server.
I want to chroot each user (client) to its home directory, and only allow it to use sftp and rsync.
I quickly discovered that I was not the only one trying to do ...
3
votes
1answer
699 views
Jail User to /var/www/username Directory via SSH
I have multiple folders in /var/www for different websites -- Apache uses name-based Virtual Hosts (Ubuntu Server). Suppose I want to allow someone to access their /var/www/user directory, but not cd ...
3
votes
3answers
1k views
Good resource for chrooting Apache2 on Debian
I need a better resource than this or this on how to secure Apache2 using chroot on a Debian system. It seems most articles deal with Apache1. I tried to follow them and adapt to Apache2, but it only ...
3
votes
2answers
3k views
SFTP fatal bad ownership or modes for chroot directory ubuntu 12.04
I just set up my SFTP server and it works fine when I use it from my first user account.
I wanted to add a user which we will call 'magnarp'.
At first I did like this in sshd_config:
Subsystem sftp ...
3
votes
3answers
2k views
set up a chrooted SFTP login with OpenSSH
How might I create an SFTP login for an untrusted user in which he can only access the files in his own home directory and not run any commands?
The online tutorial OpenSSH SFTP chroot() with ...
3
votes
1answer
139 views
Resource consumption of FreeBSD's jails
Just for curiosity. An example machine: an dedicated amd64 server with the last stable version of FreeBSD and UFS for the partitions.
How much resources consume FreeBSD for each empty jail? I mean, I ...
3
votes
2answers
3k views
Proftpd: How to set default root to a users home directory without jailing the user?
I've installed proftpd on my debian box but I'm having having some trouble with the configuration.
In my proftpd.conf I've added;
DefaultRoot ~ !ftp_special
This works fine in that all users except ...
3
votes
3answers
2k views
How to chroot Apache on CentOS?
I have been advised by a sysadmin, to run Apache in a chroot jail, in order to prevent that an attacker could take control of server.
So my question is:
What is the best method to chroot ...
3
votes
2answers
760 views
What is the secure way to isolate ftp server users on unix?
I've read documentation for various ftp daemons and various long threads about the security implications of using a chroot environment for an ftp server when giving users write access. If you read the ...
3
votes
1answer
800 views
Increasing permissiveness/permissions for umask + openssh + chrooted SFTP server using internal-sftp
The suggestion found at these links works for me:
How to setup ssh's umask for all type of connections
http://ubuntuforums.org/showthread.php?t=1107974#5
Summary: Use PAM to inject the umask, ...
2
votes
3answers
493 views
Disable Linux Commands
I'm writing a simple program to back-up some files to a Linux box. The transaction will take place over SSH and each copy of the program will have its own account on the Linux box that it will ...
2
votes
2answers
1k views
Access files outside a chroot'ed environment?
I need to setup some users to access our server. I thought the most secure way to allow them access was to setup a chroot'ed jail for them to log into.
But I need them to access a few select ...
2
votes
2answers
76 views
How to create a link outside of the jail, but accessable within the jail?
I have created a chroot jail, but now I want to be able to create a link within the jail which links outside of the jail. Is this possible?
2
votes
2answers
230 views
Why chroot is considered insecure?
I've been playing around with CentOS box for couple of years now. So I'm pretty comfy with terminal. However, I read a lot of blog-post claiming that chroot is insecure and amount of those posts ...
2
votes
2answers
313 views
Defining hard links in puppet
Is there a way to define hardlinks inside puppet manifest?
It seems file type can only define symbolic links, but I need it to be hard links in order to make some of my chrooted applications to work. ...
2
votes
1answer
814 views
Is it advisable to run Apache in a chroot jail?
I have been advised by a sysadmin guy I know, to run Apache in a chroot jail, for increased security.
I have the following questions:
Is this advisable (i.e. are there any 'gotcha's that I need to ...
2
votes
2answers
730 views
Is Chrooting apache/mysql/php a standard practice of securing web servers containing sensitive data?
Is Chrooting apache/mysql/php a standard practice of securing web servers containing sensitive data (is it necessary)?
2
votes
3answers
2k views
chrooting php-fpm with nginx
I'm setting up a new server with PHP 5.3.9 and nginx, so I compiled PHP with the php-fpm SAPI options. By itself it works great using the following server entry in nginx:
server {
listen 80;
...
2
votes
2answers
1k views
Chroot for Mysql running on Ubuntu 10.10?
Prompted from a question about MySQL server security best practices, I've been running through this list (with a few minor alterations) to properly secure my server database server:
...
2
votes
2answers
296 views
Apache Error Log - “Web Path” instead of Filesystem Path
I'm running Apache on Linux and I'm using OpenSSH to provide SFTP access to some customers so they can upload their pages and also look at their respective site logs (access & error). I'm using ...
2
votes
2answers
962 views
What is the right way to chroot perl script?
I created /opt/chroot, create bin lib and other directories in it, copied libraries, bash and perl binaries in proper places. Also I placed my script into /opt/chroot/bin/.
Now I can run the script ...
2
votes
2answers
253 views
How to map authenticated Nginx users to their own directory?
I am writing a social networking site in C and serving it all up with Nginx. How can I make it so that authenticated users go to their own directory -ONLY- where a user-specific index.html resides. ...
2
votes
1answer
417 views
Debian: ip/network changes within chroot/jail
I've Debian Squeeze running and setup a chroot environment (/jail) with debootstrap.
As seen in a tutorial, I mounted the following:
proc on /jail/proc type proc (rw)
devpts on /jail/dev/pts type ...
2
votes
2answers
867 views
Is MySecureShell a good way to manage SFTP user with chroot on a Centos Server?
I need to setup my Centos 5.4 server for SFTP with chrooted access only (or equivalent).
The regular solution using RSSH find here : ...
2
votes
1answer
973 views
How to set chroot for SFTP under Ubuntu 8.04?
Ubuntu 8.04 LTS comes with OpenSSH 4.7, before the ChrootDirectory parameter was introduced. How can I upgrade OpenSSH to 4.9+? Alternatively, without upgrading OpenSSH, how can I set chroot?
2
votes
2answers
138 views
SFTP post upload hook
How would I run a script after a file has been successfully uploaded over (a chrooted) SFTP?
I have this working on standard FTP connection using PureFTP
...
2
votes
2answers
591 views
User can't SFTP after chroot
Ubuntu 10.04.4 LTS
I'm trying to chroot the user 'sam'. According to all the articles out there this should work, but apparently I'm still doing something wrong.
The user:
...
2
votes
4answers
1k views
OpenSSH anything like 'internal-sftp' but for SCP?
I'm running Debian stable and I'm looking to establish the following environment for users in my 'sftponly' group:
jailed
can transfer with SFTP
can transfer with SCP
cannot login interactively with ...
2
votes
1answer
120 views
Link all LXC node APT caches to the host machine's APT cache
I have a number of LXC containers (ubuntu template) which all have their own separate APT caches.
/var/lib/lxc/*/rootfs/var/cache/apt/archives/
I would like to have these linked to the host ...
2
votes
2answers
408 views
bind9 in a chroot jail - necessary or not?
I always used to keep my bind9 installation in a chroot jail. Now I upgraded my vServer and have to install bind9 over again. Due to the virtualization solution my hosting provider uses, I cannot ...
2
votes
1answer
2k views
Running BIND9 In chroot
I am trying to running bind9, on a ubuntu box, in a chroot jail, as discussed in "Linux System Administration" (Adelstein & Lubanovic). The command "sudo /etc/init.d/bind9 start" is generating ...
2
votes
2answers
168 views
How to setup a public rsync and sftp server
I want to setup a public storage server which allows sftp and rsync (through ssh). I've got it working with a chroot jail and rssh. When the user connects to the server with sftp he can read all the ...
2
votes
2answers
164 views
Security of chroot and linux binaries
I'd like to verify the security of chroot and default programs in a linux distribution (say Ubuntu).
Example:
I set up jail directory 'A'. Every linux binary from the distribution is placed in 'A' ...
2
votes
1answer
412 views
jailkit chroot terminates ssh login
I've done my very best to follow these instructions to create a chroot shell. But the connection get's terminated every time I try to login via ssh for my new chrooted user.
I start my ssh terminal, ...
2
votes
1answer
287 views
Updating (and configuring) chroots on general purpose CentOS webserver with yum?
I'm currently providing web hosting on a shared web hosting VPS environment - that has no chroot. This is obviously a big security concern, although I've made sure that only the owners of files can ...
2
votes
2answers
4k views
How do I unmount a bound /proc in a “dead” chroot?
I built a debootstrap chroot and bound /proc to it, i.e. sudo mount -o bind /proc <chroot>/proc
When I found I no longer needed it, I quite stupidly rm -r <chroot>'d it. Of course, rm ...
2
votes
1answer
934 views
Is there an available repository to update OpenSSH to 4.8+ on Centos 5.4?
I need OpenSSH 4.8+ in order to do setup a clean chrooted SFTP on my Centos 5.4 with Remi and EPEL repositories.
Is there a repository for Centos which contain an updated OpenSSH?
Thanks!
Extra ...
2
votes
2answers
115 views
can not run java inside grsec chroot
java runs well inside common chroot.
however in a grsec hardened chroot it complains it has no enough memory to build VM.
any ideas of how to make it run cause i really need a hardened chroot.
...
