Tag Info

Hot answers tagged

19

The error message is misleading: /bin/bash: No such file or directory can mean either that /bin/bash doesn't exist, or that the dynamic loader used by /bin/bash doesn't exist. (You'll also get this message for a script if the interpreter on the #! line doesn't exist.) /bin/bash is looking for /lib64/ld-linux-x86-64.so.2 but you provided ...


16

Symlinks are purely symbolic: they contain nothing but a path, so when you open a symlink, the OS reads the path and uses that instead. In a chroot environment, links (especially ones with absolute paths) typically don't point to the same place they pointed to in the normal environment. If the server OS is Linux, your best bet is to bind-mount the entire ...


12

I am using rssh for this purpose. You are right there is a new way to do it and it is a built-in feature of recent ssh versions. Here is an article on Undeadly.


12

When the answer isn't 'for security purposes.' See Abusing chroot. When it was suggested that chroot is frequently used as a security tool, Adrian Bunk retorted, "incompetent people implementing security solutions are a real problem." Alan added, "chroot is not and never has been a security tool. People have built things based upon the ...


11

As @Some Guy mentioned you have to think about this in historical perspective. The historical perspective was that a single piece of hardware was a dozen or so of different services under a single operating system. If one service was compromised then everything on that hardware was compromised. With virtualization this is far less of an issue. While it ...


10

If a non-privileged user could execute a setuid program in a chroot jail, they could carefully construct that jail to trick the program into escalating privileges. For example, I can construct a chroot jail in which I'm permitted to use sudo, because I can control every configuration file inside that jail.


10

The authorized_keys file for an account can specify a command to be used whenever a specific key is used for authentication. This will require you to set up authentication using keys instead of user/password- although imho that's a good thing to do anyway. For example, gitosis uses this method to allow people to connect to a server using ssh to tunnel the ...


9

The other answers are pretty good but fail to mention the concept of security in layers. Every layer of security you add to your system is another layer that an adversary must overcome. Putting BIND in a chroot adds one more obstacle. Say there is an exploitable vulnerability in BIND and someone is able to execute arbitrary code. If they're in a chroot, ...


8

Because, in most instances, a root process can easily exit the chroot. This is by design, as chroot was never intended as a security device. Alan Cox somewhat famously berated a developer that submitted a kernel patch to "fix" this behavior, claiming that chroot has been abused as a security device, but was never intended to be one.


8

Yes, the tool is called mock and it's in EPEL. Typical usage: rpmbuild -bs mypackage.spec mock -r epel-6-x86_64 mypackage-0.1-1.src.rpm This is actually the preferred way to build RPMs, precisely because it isolates the process from the system so that unexpected dependencies don't get pulled in. You can modify the files in /etc/mock to have it pull in ...


8

You should never consider a chroot a complete security feature. While is makes attack harder, if you do manage to get some control inside the chroot, it is fairly easy to break out of. There's a method involving chrooting to a parent directory (..) More info here. The reason that chroot gives some security benefit is that many of the applications that a ...


8

This is a place where a bind mount will do what you want.


8

There are two main categories of uses for chroot (the Wikipedia article goes into more detail): Isolate an application, providing it with a restricted view of the filesystem. This is commonly done for public FTP servers, for example, to make sure they won't be able to serve files outside the public area even if there's a bug in the server software. This ...


8

An sftp solution would also require an ssh login for everyone, so you haven't really lost anything here. Granting ssh access does not necessarily imply full shell access, for example, this shows how to use the ssh authorized_keys file to allow backup via rsync while limiting available commands to just the rsync receiver. In fact, if you opt for key based ...


8

You want to use the usermod command. You're going to want to use the -m and -d directives to modify their home directory and move its contents: -d, --home HOME_DIR The users new login directory. If the -m option is given, the contents of the current home directory will be moved to the new home directory, which is created if ...


7

sshd has a certain level of paranoia when it comes to chroot directories. I do not think this can be disabled (even with StrictModes no). The chroot directory and all parent directories must be properly set: The chroot directory and all of its parents must not have group or world write capabilities (ie chmod 755) The chroot directory and all of its ...


7

On Linux the chroot(2) system call can only be made by a process that is privileged. The capability the process needs is CAP_SYS_CHROOT. The reason you can't chroot as a user is pretty simple. Assume you have a setuid program such as sudo that checks /etc/sudoers if you are allowed to do something. Now put it in a chroot chroot with your own /etc/sudoers. ...


7

You need to add ForceCommand internal-sftp after Match User user_www line. This forces OpenSSH to use its internal sftp implementation instead of trying to execute the external sftp-server command, which cannot be accessed from inside the chroot jail.


6

Quoth the man page: ChrootDirectory Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory. ...nevermore. My guess is one ...


6

Linux Containers (LXC) are an operating system-level virtualization method for running multiple isolated server installs (containers) on a single control host. LXC does not provide a virtual machine, but rather provides a virtual environment that has its own process and network space. It is similar to a chroot, but offers much more isolation. Linux ...


6

The 'match' feature in sshd_config allows you to specify rules based on group membership or username. Match user joe ChrootDirectory /storage/public ForceCommand /usr/libexec/sftp-server


6

No, chrooting isn't standard practice with Apache. I wouldn't consider it necessary either. However, chuser and chgroup are-- you shouldn't run Apache as root. Doing all three is common with BIND. You should default to running with least privileges necessary with all daemons and all cases. It's arguable that chrooting is pointless in a lot of cases as ...


6

I just had to setup one user who would be able to log in via ssh and the ssh to another server (which is not directly connected to the outside world). The links by cstamas and ericmayo were a good start. Basically, I added the following to /etc/ssh/sshd_config: Match User myuser ChrootDirectory /chroot/myuser From there on, I just had to create the ...


6

What you want is not actually a chroot. You want the DefaultRoot setting in ProFTPd. You can set that in Virtualmin by browsing to Webmin>Servers>ProFTPd Server>Files and Directories, and set the option labeled "Limit users to directories" to "Home directory". Save it, and click "Apply changes" in the upper right corner.


6

If you have a program that require a set/versions of libraries which is different from what is installed on your system, that would be a good candidate for a "chrooted" install. chroot is also handy for installing different version of Linux distribution inside their own environment, without using a VM or emulator (Setting up a Debian chroot under Red Hat).


6

Execute usual rsync from client to remote server, but add additional verbose switch: SSH -v, then grep for Sending command. You will see exact command client is sending to remote server: rsync -avz -e'ssh -v -i /ssh-keys/clientprivate.key' --bwlimit=8000 --delete root@server:/path/ /backup/myserver/ 2>&1 | grep "Sending command" In my case, it was ...


5

as i am see it is a bug you should try to run the schroot command from the / directory or anyother but not some directory under /home.


5

Chroot provides a small bit of security to provide a speed-bump for an attacker. If you have a vulnerability in apache/CGIs, an attacker has to escape the chroot jail. Automated attacks are less likely to try to do this, but if there is a known kernel exploit and the requirements for that exploit are obtainable in the chrooted environment, you are hosed. ...


5

How about using pivot_root to switch to a temporary, in-memory filesystem root? See http://www.ivarch.com/blogs/oss/2007/01/resize-a-live-root-fs-a-howto.shtml.


5

You can use also the statement "exec" if you can't find any other way. exec { "hardlink1": command => "ln target source", path => "/usr/local/bin:/bin", creates => "yourhardlink" }



Only top voted, non community-wiki answers of a minimum length are eligible