Tag Info

Hot answers tagged

5

Yes, as Christopher said, a bind mount will work. But I think it will work only with directories and not at file level. If you need file links you can use hard links but it will only work within a Linux ext filesystem (don't know if other fs support it) See Here for a description of the difference between hard and soft links.


5

The only method I can think of is used of a bind mount. A quick google found http://docs.1h.com/Bind_mounts


5

Chrooting is a good security measure, it limits the possibilities to compromise the system in case of a successfull exploit but there are also ways in some case to evade from a chroot, so it is not a definitive way to protect the system. I'm not aware of any disavantage regarding performance and scalability. Concerning database access, it is generaly done ...


4

On Linux the chroot(2) system call can only be made by a process that is privileged. The capability the process needs is CAP_SYS_CHROOT. The reason you can't chroot as a user is pretty simple. Assume you have a setuid program such as sudo that checks /etc/sudoers if you are allowed to do something. Now put it in a chroot chroot with your own /etc/sudoers. ...


4

I am guessing this is related to an earlier question? http://serverfault.com/questions/135599/ubuntu-can-non-root-user-run-process-in-chroot-jail To run Tomcat as root...* Assuming you have installed the tomcat6 package from the Ubuntu repository edit the /etc/init.d/tomcat6 file and change the line: TOMCAT6_USER=tomcat6 to read TOMCAT6_USER=root ...


4

Here is a sample configuration section that you can put in /etc/jailkit/jk_init.ini so that future jail adds are seamless. I used this section [mysql-client] comment = mysql client executables = /usr/bin/mysql paths = /usr/lib/libmysqlclient.so.16.0.0 , /usr/lib/libmysqlclient.so.16, /usr/lib/libstdc++.so.6,/usr/lib/libstdc++.so.6.0.13,/lib/libgcc_s.so.1 ...


4

You can install and configure suPHP. suPHP is an apache module that runs the user's scripts as their own uid instead of apache's. Since the scripts all run as their own uid, simple file permissions take care of keeping them out of other user's directories, and anything else the apache user has access to. The file system permissions also stop them from ...


3

Firstly turn you SSH logs to DEBUG3 by replacing in the sshd_config file : LogLevel INFO by LogLevel DEBUG3 You will see more information why SSH did close the connection. Then Ensure you have all the shell need to run in chrooted environment : The user home is there with the right permissions All shell need to be lauched in the chroot directory (shell ...


3

Sounds like you're missing /usr/lib/locale inside your chroot. Try copying them into place from your non-chroot'd /usr/lib/locale or chroot with LANG=C.


3

When you chroot, the named directory becomes /. The correct shell path inside the chroot is then /bin/bash, not /home/matt/bin/bash. You will also need to make sure there's enough other stuff inside the chroot for the system to work. You can test this with sudo chroot /home/matt /bin/bash and see what works and what doesn't; at the very least, you will ...


3

Assuming you mean ifconfig, this is in my opinion not a scenario for which chroot is well-suited. You would do better to allow the user a normal login, relying on the normal system protections (which are pretty mature on UNIX/Linux) to prevent them being accidentally-destructive, and then use sudo to give fine-grained access to the relevant system commands. ...


3

The problem is not in the terminal settings, they are surely o.k., because nano and other ncurses programs work. The problem is nearly surely on the command line things, which are handled by the readline library. Its configuration file named as inputrc. It can be found either in /etc/inputrc, or in ~/.inputrc in your home. The first is or isn't copied by ...


2

I had the same problem. No chroot, you could see all the files. When I allow chroot I can't log in my ftp server. How did I resolve it? Appended this to configuration file: allow_writeable_chroot=YES http://www.benscobie.com/fixing-500-oops-vsftpd-refusing-to-run-with-writable-root-inside-chroot/


2

Since you have jailed the user, /home/test3 will become a root directory for logged in user. To access it you should specify the path correctly, either absolyte or relative: git clone domain.com:/home/test3.git


2

I search for it toooooooooo many, and i really mixed up, so i decided to change vsftpd to sftp or something else, till i found a link about this bugg. Then i found out this problem is solved in vsftpd version 3. So i search how to upgrade it and could found to add jessie repository my debian 7.3 and upgrade it so: echo "deb http://ftp.us.debian.org/debian ...


2

Quoth the man page: ChrootDirectory Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory. ...nevermore. My guess is one ...


2

You need to add: passwd_chroot_enable=YES From the man page: passwd_chroot_enable If enabled, along with chroot_local_user , then a chroot() jail location may be specified on a per-user basis. Each user's jail is derived from their home directory string in /etc/passwd.


1

I disabled SELinux and rebooted, then everything works fine now.


1

You need to pay close attention to the notes about permissions on the ChrootDirectory section of the man page. Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory ...


1

What good is a chroot for if it drops you to / by default? The purpose of chrooting users to their home directory is to prevent them wandering around elsewhere -- the lack of homedir would defeat that and be horribly error prone.


1

I'm guessing because it's useful for the user to start off in their home directory when they connect, instead of being dropped into / (or somewhere else) and having to cd into their home directory most of the time. The home directory should be taken from /etc/passwd though, so you can set it to anything you like (it doesn't have to be ...


1

You need to edit /etc/apparmor.d/usr.sbin.named to give Bind permission to access those files in the chroot. You basically want to modify all the paths specified there to be prefixed by the chroot location. Run service apparmor reload after making the changes.


1

There is the jk_cp command. E.g. use jk_cp -j /var/www/clients/client2/web16 /usr/bin/hg to copy the needed file(s).


1

To get virtualenv available in shell automatically you should source its bin/activate script every time the user logs in. You can do this along with creating default virtualenv environment when the user is created. Or you can just add path to the virtualenv's python interpreter to the $PATH variable right in the user's .bash_login, .zshrc or whatever else. ...


1

What you are asking for is not possible using (only) chroot, as /web/userDir and /web/groupDir share /web as their lowest common root. Forcing them to use sftp and limiting them to /web is as close as you can get: Match group webusers ForceCommand internal-sftp X11Forwarding no AllowTcpForwarding no ChrootDirectory /web The ...


1

A symbolic link is a pointer to the "right" file. But if that original file is outside the jail then you can't access it. This is the goal of a jail. Otherwise a normal user could create a symbolic link in the jail to /etc/passwd and just read it. What a security risk! So jailed is jailed. Probably a hard link will do the job, as this is a "copy without ...


1

I cannot specifically answer your question, so mod me down if you like. However, many people before me, and many after, will confirm for you the obvious: that chroot jail is not a security mechanism (you talked about Linux; BSD jails are different enough I am not talking about them). To quote a very well-known kernel hacker, Alan Cox, they are not a ...


1

Okay, Problem sovled. Don't you just love solving your own problems! The problem was that the chrooted home directory didn't have the right permissions. As I discovered by looking at the log.


1

Figured it out anyhow! Just find out where the php & mysql binaries reside (/user/bin or /user/sbin) and copy them to the relative chroot directory. Then when you run the php command from the chroot user you'll get an error saying such and such a libary is missing so then you've just got to find that libaray and copy it into the relative chroot ...


1

The first step is to generate a rpmdb within the chroot by creating /var/lib/rpm within it and using rpm --root /path/to/chroot --initdb. After that you need to install the $distro-release package within it with rpm so that yum has information about the distro whose repos it needs to access. Once you've done that you can use yum --installroot=/path/to/chroot ...



Only top voted, non community-wiki answers of a minimum length are eligible