Tag Info

Hot answers tagged

6

On Linux the chroot(2) system call can only be made by a process that is privileged. The capability the process needs is CAP_SYS_CHROOT. The reason you can't chroot as a user is pretty simple. Assume you have a setuid program such as sudo that checks /etc/sudoers if you are allowed to do something. Now put it in a chroot chroot with your own /etc/sudoers. ...


6

Quoth the man page: ChrootDirectory Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory. ...nevermore. My guess is one ...


5

Chrooting is a good security measure, it limits the possibilities to compromise the system in case of a successfull exploit but there are also ways in some case to evade from a chroot, so it is not a definitive way to protect the system. I'm not aware of any disavantage regarding performance and scalability. Concerning database access, it is generaly done ...


5

The only method I can think of is used of a bind mount. A quick google found http://docs.1h.com/Bind_mounts


5

Yes, as Christopher said, a bind mount will work. But I think it will work only with directories and not at file level. If you need file links you can use hard links but it will only work within a Linux ext filesystem (don't know if other fs support it) See Here for a description of the difference between hard and soft links.


4

I am guessing this is related to an earlier question? http://serverfault.com/questions/135599/ubuntu-can-non-root-user-run-process-in-chroot-jail To run Tomcat as root...* Assuming you have installed the tomcat6 package from the Ubuntu repository edit the /etc/init.d/tomcat6 file and change the line: TOMCAT6_USER=tomcat6 to read TOMCAT6_USER=root ...


4

Here is a sample configuration section that you can put in /etc/jailkit/jk_init.ini so that future jail adds are seamless. I used this section [mysql-client] comment = mysql client executables = /usr/bin/mysql paths = /usr/lib/libmysqlclient.so.16.0.0 , /usr/lib/libmysqlclient.so.16, /usr/lib/libstdc++.so.6,/usr/lib/libstdc++.so.6.0.13,/lib/libgcc_s.so.1 ...


4

You can install and configure suPHP. suPHP is an apache module that runs the user's scripts as their own uid instead of apache's. Since the scripts all run as their own uid, simple file permissions take care of keeping them out of other user's directories, and anything else the apache user has access to. The file system permissions also stop them from ...


4

The problem is not in the terminal settings, they are surely o.k., because nano and other ncurses programs work. The problem is nearly surely on the command line things, which are handled by the readline library. Its configuration file named as inputrc. It can be found either in /etc/inputrc, or in ~/.inputrc in your home. The first is or isn't copied by ...


3

Firstly turn you SSH logs to DEBUG3 by replacing in the sshd_config file : LogLevel INFO by LogLevel DEBUG3 You will see more information why SSH did close the connection. Then Ensure you have all the shell need to run in chrooted environment : The user home is there with the right permissions All shell need to be lauched in the chroot directory (shell ...


3

Assuming you mean ifconfig, this is in my opinion not a scenario for which chroot is well-suited. You would do better to allow the user a normal login, relying on the normal system protections (which are pretty mature on UNIX/Linux) to prevent them being accidentally-destructive, and then use sudo to give fine-grained access to the relevant system commands. ...


3

Sounds like you're missing /usr/lib/locale inside your chroot. Try copying them into place from your non-chroot'd /usr/lib/locale or chroot with LANG=C.


3

When you chroot, the named directory becomes /. The correct shell path inside the chroot is then /bin/bash, not /home/matt/bin/bash. You will also need to make sure there's enough other stuff inside the chroot for the system to work. You can test this with sudo chroot /home/matt /bin/bash and see what works and what doesn't; at the very least, you will ...


2

Since you have jailed the user, /home/test3 will become a root directory for logged in user. To access it you should specify the path correctly, either absolyte or relative: git clone domain.com:/home/test3.git


2

I had the same problem. No chroot, you could see all the files. When I allow chroot I can't log in my ftp server. How did I resolve it? Appended this to configuration file: allow_writeable_chroot=YES http://www.benscobie.com/fixing-500-oops-vsftpd-refusing-to-run-with-writable-root-inside-chroot/


2

I search for it toooooooooo many, and i really mixed up, so i decided to change vsftpd to sftp or something else, till i found a link about this bugg. Then i found out this problem is solved in vsftpd version 3. So i search how to upgrade it and could found to add jessie repository my debian 7.3 and upgrade it so: echo "deb http://ftp.us.debian.org/debian ...


2

These days, you want to be looking at LXC (Linux Containers) instead of chroot/BSD jail. It's somewhere between a chroot and a virtual machine, giving you a lot of security control and general configurability. I believe all you need to run it as a user is to be a member of the group that owns the necessary files/devices, but there might also be ...


2

You need to add: passwd_chroot_enable=YES From the man page: passwd_chroot_enable If enabled, along with chroot_local_user , then a chroot() jail location may be specified on a per-user basis. Each user's jail is derived from their home directory string in /etc/passwd.


2

You can easily circumvent ForceCommand since it kicks in when you shell has started. This essentially means that your shell rc file is processed first and then ForceCommand if you allow it to get there. Simple exec sh in your shell rc file will spawn up another shell and keep ForceCommand waiting until you exit this shell. So bottom line; if user can ...


1

The way I use a bastion host is using ProxyCommand and the -W flag as in this example: ssh -o ProxyCommand='ssh -W %h:%p user@bastion' user@machine I use this approach for security reasons. The communication between client and target machine is encrypted and authenticated end-to-end, which means it remains secured even if the bastion is compromised. A ...


1

I imagine that's fine most of the time, but the problem with security is the things noone has gotten around to thinking about yet. There are no guarantees. Like for instance for a long time noone had thought too hard about the way functions could be created from environment variables in bash, but recently people realised that could be subverted, and one of ...


1

ChrootDirectory directory must be owned by root and have 755 mode: sudo chown root:root /var/www/RESTRICTED_DIR sudo chmod 755 /var/www/RESTRICTED_DIR Ok, now all files into /var/www/RESTRICTED_DIR must be owned by MY_USER, which must belong to www-data group, and have 775 mode to allow group permissions, like this: sudo usermod -a -G MY_USER www-data ...


1

@imz--IvanZakharyaschev comments on pehrs's answer that it may be possible with the introduction of namespaces, but this hasn't been tested and posted as an answer. Yes, that does indeed make it possible for a non-root user to use chroot. Given a statically-linked dash, and a statically-linked busybox, and a running bash shell running as non-root: $ mkdir ...


1

Couldn't you set the sticky bit of the software package executable? This would have it always run as the owner of the file, which would be root in this case. Make the binary executable by all users (or at least, a group which includes tomcat6) and set the user sticky bit. $sudo chmod +x binary OR $sudo chmod 750 binary //(with tomcat6 in the group of the ...


1

If you're writing C, why not just use the inotify lib? Or if you're just writing a simple shell script, you can use watch. Both are in all modern Linux variants.


1

Jailing users is generally a huge chore. I'm not 100% sure on your implementation but its' almost certain that your bind mount to /usr and /lib specifically BREAK the jail. That's like providing an inmate with their own personal tunnel to the outside world ... it's just exactly what a chroot was supposed to avoid. Instead you'll need to setup your jail ...


1

SELinux will allow you to start the application in a restricted domain, and the audit subsystem will let you watch what it does.


1

check lxc, Linux Containers. It's a 'better chroot than chroot', like Solaris containers or BSD jails, also comparable to OpenVZ or VServer. The base concept is to isolate some views of the system from a process. For example, if you isolate the PID tree, the process starts a new tree: sees itself as PID #1, and subprocesses see only that subtree. Other ...


1

The documentation isn't terribly clear on how to do this, and it's hard to judge what you're missing without seeing your whole config file. A shot in the dark: passwd_chroot_enable If enabled, along with chroot_local_user, then a chroot() jail location may be specified on a per-user basis. Each user's jail is derived from ...


1

The first step is to generate a rpmdb within the chroot by creating /var/lib/rpm within it and using rpm --root /path/to/chroot --initdb. After that you need to install the $distro-release package within it with rpm so that yum has information about the distro whose repos it needs to access. Once you've done that you can use yum --installroot=/path/to/chroot ...



Only top voted, non community-wiki answers of a minimum length are eligible