18
votes
Accepted
Chroot SFTP - Possible to allow user to write to current (chroot) directory
Hey @emmdee It took me forever to realize there is a simple and nice trick to that. You just have to make root the owner of a parent folder to where you wanna sFTP, then use force command to tell a ...
- 196
13
votes
Accepted
yum/rpm Failed to initialize NSS library in chroot
Special thank you to TrevorH and jhodrien on #centos.
The problem was that chroot prevents access to /dev/urandom (as desgined). The update installed to succeeded required those random bits to ...
- 628
11
votes
vsftp: why is allow_writeable_chroot=YES a bad idea?
If the FTP credentials of a user (even a virtual user) with a writeable chroot get compromised, the attacker might conceivably be able to perform a ROARING BEAST ATTACK. To summarise my rough ...
- 747
8
votes
Accepted
How to disallow the Docker Daemon to mount host's root file system into the container
SELinux will prevent anything not correctly labelled to be mounted as a volume inside a docker container, as proof, here using a single file, same policy applies to directories:
$ sestatus
SELinux ...
- 15.3k
7
votes
Accepted
SFTP suddenly failing for chroot accounts on Amazon Linux
Edit: This should be fixed in openssh-6.6.1p1-32.el7 per
https://bugzilla.redhat.com/show_bug.cgi?id=1398569
It appears after the OpenSSH-6.6.1p1-31 update, only the user's primary group is checked ...
- 86
7
votes
Accepted
Up-to-date alternatives of rssh or scponly
I recommend to just use the common chrooted internal-sftp that is included with most OpenSSH servers. SFTP clients are available on all operating systems so I do not see any problems with adoption.
...
6
votes
Is there a windows equivalent to chroot?
To solve this specific need (program assumes it's running off of a root directory), the SUBST command is probably what you want. It's a holdover from DOS, and still exists in windows 10.
the SUBST ...
- 161
6
votes
Accepted
Why did the postfix default change to non-chroot processes?
If you download the Postfix source code and examine the HISTORY file, you can see that this change was made on the 1st October 2014 (Snapshot 20141001):
New defaults for master.cf chroot (n), ...
- 2,888
6
votes
Chroot SFTP - Possible to allow user to write to current (chroot) directory
I know its been a couple of years, but this post got me 98% of the way there. after searching for a long time.
To make it so that I can have users chrooted and automatically get them into their own ...
- 61
5
votes
Accepted
How to let OPcache work correctly under chroot?
This is famous bug: https://bugs.php.net/bug.php?id=69090
which was present for years. But not anymore.
So, update your PHP version, and add this to php.ini:
opcache.validate_root=1
This will make ...
- 66
4
votes
User can't SFTP after chroot
Centos 7 - I had the same issue - I tried everything under the sun to diagnose it - eventually I changed the sftp subsystem in '/etc/ssh/sshd_conf', restarted sshd (service sshd restart) and the ...
- 63
4
votes
bad ownership or modes for chroot directory component
In my case below steps worked.
useradd -d /data/ftp/user1 -s /bin/false -g users -G sftponly user1
passwd user1
chown root:root /data/ftp/user1
rights for group & others chmod go+rx /data/ftp/...
- 41
4
votes
bad ownership or modes for chroot directory component
After some troubleshooting today, I realized that root must also be able to write to the directories.
The following did not work:
$ ls -ld /mnt/synology03/files/
dr-xr-xr-x 1 root root 156 Oct 8 20:...
- 41
4
votes
Up-to-date alternatives of rssh or scponly
One possibility is ProFTPD's mod_sftp module, which does just what you want (chroot, SCP/SFTP only, no shell).
Hope this helps!
- 3,379
4
votes
Accepted
A simple, step-by-step way of setting up of "jailed" SFTP-only accounts
OK, I finally got it working. There were a few things I was doing wrong, and obviously my attempts to do it over and over again screwed up some settings so I just hosed the instance and started from ...
- 263
4
votes
chroot, gpg-agent, and Ubuntu 18.04
It actually was the .gnupg directory that could not be created. The home directory specified in /etc/passwd (/html) is relative during the SFTP session, but understood as absolute path during the ...
- 910
3
votes
Running BIND9 In chroot on Ubuntu 16.04 xenial
I think, at its core, this boils down to a more general question about how to run something chrooted.
The chroot directory which you prepare must contain all the files needed at run-time and if this ...
- 35.5k
3
votes
Accepted
How to disable systemcalls in ftp environment with vsftpd?
Commands that start with an exclamation mark ! escape the FTP client and are executed locally with the rights of your local user. The don't run on the server, actually they won't even reach the ...
- 80.3k
3
votes
Accepted
How to prevent sftp users from viewing some directories (inside their chroot directory)
The standard unix-style file permissions used by sftp does not support the thing you are looking for.
- 241
3
votes
Chroot jail not working with VSFTPD
It is an old thread I know. Had the same problem using debian wheezy on a Raspberry Pi and found out that everytime during login automatically the sftp-server became active (checked via ps -ef).
...
- 31
3
votes
Accepted
Create Linux user with no capabilities
You can easily restrict what an SSH session can do if you use ssh keys and use the command= option in ~/.ssh/authorized_keys:
Create a key pair for the user on machine1 that should initiate the ...
- 99.6k
3
votes
Accepted
Logging Chrooted SFTP user activity
Your assumption that /dev/log is a file that can be shared via bind-mounting /dev is incorrect for most modern linux distributions using systemd. Therefore, mounting your systems /dev into your chroot ...
- 9,783
3
votes
Logging Chrooted SFTP user activity
If you do not use rsyslogd and use only journald from systemd, you can do the following (source https://wiki.archlinux.org/index.php/SFTP_chroot#Logging)
(Please replace <OPENSSH_CHROOT_PATH> ...
- 31
3
votes
Accepted
Bind mount - different results on CentOS 6 and CentOS 7
The source of the behaviour seems the changed default of the shared subtrees operation. The kernel documentation Documentation/sharedsubtree.txt mentions that private is the default, whereas actually ...
- 4,305
3
votes
Accepted
Execute half of the %post section of a kickstart in a nochroot environment and the other half in a chroot environment
%post --nochroot --logfile=/mnt/sysimage/root/ks-post.log
cp /run/install/repo/script.sh /mnt/sysimage/root/
chroot /mnt/sysimage/ /bin/sh /root/script.sh
%end
- 33.3k
3
votes
Accepted
How to specify user home in sshd config?
As I understand it, the problem you're facing is that the internal-sftp call is happening after the chroot is in place, thus the %h (as well as the attempted %d) is being expanded within the chroot. ...
- 358
2
votes
OpenSSH anything like 'internal-sftp' but for SCP?
Due to a weird coincidence, you don't need to change anything if the scp clients use OpenSSH ≥8.8. Means, you can then keep your current setup using ForceCommand internal-sftp to provide a SFTP server....
- 678
2
votes
Ubuntu - can non-root user run process in chroot jail?
It seems that with user-namespaces it is in fact possible to chroot without root. Here is an example program which demonstrates that it is possible. I have only begun to explore how linux namespaces ...
- 121
2
votes
"500 OOPS: vsftpd: refusing to run with writable root inside chroot()" - login failed on Debian
Just add
seccomp_sandbox=NO
to the configuration and restart the service with service vsftpd restart
Then "allow_writeable_chroot=YES" will work also with newer vsFTPd versions
(found in 500 OOPS: ...
2
votes
Accepted
Jailkit not locking down SFTP, working for SSH
Although I definitely feel doublesharp's pain (just ran into this problem as well), doublesharp's answer here should not be used (not secure). The problem here is that sshd's internal-sftp is being ...
Only top scored, non community-wiki answers of a minimum length are eligible