Tag Info

Hot answers tagged

5

Chrooting is a good security measure, it limits the possibilities to compromise the system in case of a successfull exploit but there are also ways in some case to evade from a chroot, so it is not a definitive way to protect the system. I'm not aware of any disavantage regarding performance and scalability. Concerning database access, it is generaly done ...


5

Yes, as Christopher said, a bind mount will work. But I think it will work only with directories and not at file level. If you need file links you can use hard links but it will only work within a Linux ext filesystem (don't know if other fs support it) See Here for a description of the difference between hard and soft links.


4

Here is a sample configuration section that you can put in /etc/jailkit/jk_init.ini so that future jail adds are seamless. I used this section [mysql-client] comment = mysql client executables = /usr/bin/mysql paths = /usr/lib/libmysqlclient.so.16.0.0 , /usr/lib/libmysqlclient.so.16, /usr/lib/libstdc++.so.6,/usr/lib/libstdc++.so.6.0.13,/lib/libgcc_s.so.1 ...


4

On Linux the chroot(2) system call can only be made by a process that is privileged. The capability the process needs is CAP_SYS_CHROOT. The reason you can't chroot as a user is pretty simple. Assume you have a setuid program such as sudo that checks /etc/sudoers if you are allowed to do something. Now put it in a chroot chroot with your own /etc/sudoers. ...


4

You can install and configure suPHP. suPHP is an apache module that runs the user's scripts as their own uid instead of apache's. Since the scripts all run as their own uid, simple file permissions take care of keeping them out of other user's directories, and anything else the apache user has access to. The file system permissions also stop them from ...


3

Firstly turn you SSH logs to DEBUG3 by replacing in the sshd_config file : LogLevel INFO by LogLevel DEBUG3 You will see more information why SSH did close the connection. Then Ensure you have all the shell need to run in chrooted environment : The user home is there with the right permissions All shell need to be lauched in the chroot directory (shell ...


3

Assuming you mean ifconfig, this is in my opinion not a scenario for which chroot is well-suited. You would do better to allow the user a normal login, relying on the normal system protections (which are pretty mature on UNIX/Linux) to prevent them being accidentally-destructive, and then use sudo to give fine-grained access to the relevant system commands. ...


3

I am guessing this is related to an earlier question? http://serverfault.com/questions/135599/ubuntu-can-non-root-user-run-process-in-chroot-jail To run Tomcat as root...* Assuming you have installed the tomcat6 package from the Ubuntu repository edit the /etc/init.d/tomcat6 file and change the line: TOMCAT6_USER=tomcat6 to read TOMCAT6_USER=root ...


1

Couldn't you set the sticky bit of the software package executable? This would have it always run as the owner of the file, which would be root in this case. Make the binary executable by all users (or at least, a group which includes tomcat6) and set the user sticky bit. $sudo chmod +x binary OR $sudo chmod 750 binary //(with tomcat6 in the group of the ...


1

These days, you want to be looking at LXC (Linux Containers) instead of chroot/BSD jail. It's somewhere between a chroot and a virtual machine, giving you a lot of security control and general configurability. I believe all you need to run it as a user is to be a member of the group that owns the necessary files/devices, but there might also be ...


1

Jailing users is generally a huge chore. I'm not 100% sure on your implementation but its' almost certain that your bind mount to /usr and /lib specifically BREAK the jail. That's like providing an inmate with their own personal tunnel to the outside world ... it's just exactly what a chroot was supposed to avoid. Instead you'll need to setup your jail ...


1

check lxc, Linux Containers. It's a 'better chroot than chroot', like Solaris containers or BSD jails, also comparable to OpenVZ or VServer. The base concept is to isolate some views of the system from a process. For example, if you isolate the PID tree, the process starts a new tree: sees itself as PID #1, and subprocesses see only that subtree. Other ...


1

The documentation isn't terribly clear on how to do this, and it's hard to judge what you're missing without seeing your whole config file. A shot in the dark: passwd_chroot_enable If enabled, along with chroot_local_user, then a chroot() jail location may be specified on a per-user basis. Each user's jail is derived from ...


1

The first step is to generate a rpmdb within the chroot by creating /var/lib/rpm within it and using rpm --root /path/to/chroot --initdb. After that you need to install the $distro-release package within it with rpm so that yum has information about the distro whose repos it needs to access. Once you've done that you can use yum --installroot=/path/to/chroot ...


1

Figured it out anyhow! Just find out where the php & mysql binaries reside (/user/bin or /user/sbin) and copy them to the relative chroot directory. Then when you run the php command from the chroot user you'll get an error saying such and such a libary is missing so then you've just got to find that libaray and copy it into the relative chroot ...


1

When you chroot, the named directory becomes /. The correct shell path inside the chroot is then /bin/bash, not /home/matt/bin/bash. You will also need to make sure there's enough other stuff inside the chroot for the system to work. You can test this with sudo chroot /home/matt /bin/bash and see what works and what doesn't; at the very least, you will ...


1

I cannot specifically answer your question, so mod me down if you like. However, many people before me, and many after, will confirm for you the obvious: that chroot jail is not a security mechanism (you talked about Linux; BSD jails are different enough I am not talking about them). To quote a very well-known kernel hacker, Alan Cox, they are not a ...


1

A symbolic link is a pointer to the "right" file. But if that original file is outside the jail then you can't access it. This is the goal of a jail. Otherwise a normal user could create a symbolic link in the jail to /etc/passwd and just read it. What a security risk! So jailed is jailed. Probably a hard link will do the job, as this is a "copy without ...


1

To get virtualenv available in shell automatically you should source its bin/activate script every time the user logs in. You can do this along with creating default virtualenv environment when the user is created. Or you can just add path to the virtualenv's python interpreter to the $PATH variable right in the user's .bash_login, .zshrc or whatever else. ...


1

I'm guessing because it's useful for the user to start off in their home directory when they connect, instead of being dropped into / (or somewhere else) and having to cd into their home directory most of the time. The home directory should be taken from /etc/passwd though, so you can set it to anything you like (it doesn't have to be ...


1

You need to pay close attention to the notes about permissions on the ChrootDirectory section of the man page. Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory ...


1

I had the same problem. No chroot, you could see all the files. When I allow chroot I can't log in my ftp server. How did I resolve it? Appended this to configuration file: allow_writeable_chroot=YES http://www.benscobie.com/fixing-500-oops-vsftpd-refusing-to-run-with-writable-root-inside-chroot/


1

Quoth the man page: ChrootDirectory Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory. ...nevermore. My guess is one ...


1

What you are asking for is not possible using (only) chroot, as /web/userDir and /web/groupDir share /web as their lowest common root. Forcing them to use sftp and limiting them to /web is as close as you can get: Match group webusers ForceCommand internal-sftp X11Forwarding no AllowTcpForwarding no ChrootDirectory /web The ...


1

I recommend you to switch to more flexible FTP server like Pure-ftpd, where you can configure virtual users with the chroot dir access you want and set up uid and gid virtually. howto with mysql for Ubuntu



Only top voted, non community-wiki answers of a minimum length are eligible