Tag Info

Hot answers tagged

15

The error message is misleading: /bin/bash: No such file or directory can mean either that /bin/bash doesn't exist, or that the dynamic loader used by /bin/bash doesn't exist. (You'll also get this message for a script if the interpreter on the #! line doesn't exist.) /bin/bash is looking for /lib64/ld-linux-x86-64.so.2 but you provided ...


12

I am using rssh for this purpose. You are right there is a new way to do it and it is a built-in feature of recent ssh versions. Here is an article on Undeadly.


12

When the answer isn't 'for security purposes.' See Abusing chroot. When it was suggested that chroot is frequently used as a security tool, Adrian Bunk retorted, "incompetent people implementing security solutions are a real problem." Alan added, "chroot is not and never has been a security tool. People have built things based upon the ...


10

The authorized_keys file for an account can specify a command to be used whenever a specific key is used for authentication. This will require you to set up authentication using keys instead of user/password- although imho that's a good thing to do anyway. For example, gitosis uses this method to allow people to connect to a server using ssh to tunnel the ...


10

Symlinks are purely symbolic: they contain nothing but a path, so when you open a symlink, the OS reads the path and uses that instead. In a chroot environment, links (especially ones with absolute paths) typically don't point to the same place they pointed to in the normal environment. If the server OS is Linux, your best bet is to bind-mount the entire ...


10

If a non-privileged user could execute a setuid program in a chroot jail, they could carefully construct that jail to trick the program into escalating privileges. For example, I can construct a chroot jail in which I'm permitted to use sudo, because I can control every configuration file inside that jail.


9

As @Some Guy mentioned you have to think about this in historical perspective. The historical perspective was that a single piece of hardware was a dozen or so of different services under a single operating system. If one service was compromised then everything on that hardware was compromised. With virtualization this is far less of an issue. While it ...


9

The other answers are pretty good but fail to mention the concept of security in layers. Every layer of security you add to your system is another layer that an adversary must overcome. Putting BIND in a chroot adds one more obstacle. Say there is an exploitable vulnerability in BIND and someone is able to execute arbitrary code. If they're in a chroot, ...


8

Yes, the tool is called mock and it's in EPEL. Typical usage: rpmbuild -bs mypackage.spec mock -r epel-6-x86_64 mypackage-0.1-1.src.rpm This is actually the preferred way to build RPMs, precisely because it isolates the process from the system so that unexpected dependencies don't get pulled in. You can modify the files in /etc/mock to have it pull in ...


8

You should never consider a chroot a complete security feature. While is makes attack harder, if you do manage to get some control inside the chroot, it is fairly easy to break out of. There's a method involving chrooting to a parent directory (..) More info here. The reason that chroot gives some security benefit is that many of the applications that a ...


8

This is a place where a bind mount will do what you want.


8

You want to use the usermod command. You are going to want to use the -m and -d directives to modify their home directory. -d, --home HOME_DIR The users new login directory. If the -m option is given, the contents of the current home directory will be moved to the new home directory, which is created if it does not ...


7

There are two main categories of uses for chroot (the Wikipedia article goes into more detail): Isolate an application, providing it with a restricted view of the filesystem. This is commonly done for public FTP servers, for example, to make sure they won't be able to serve files outside the public area even if there's a bug in the server software. This ...


7

You need to add ForceCommand internal-sftp after Match User user_www line. This forces OpenSSH to use its internal sftp implementation instead of trying to execute the external sftp-server command, which cannot be accessed from inside the chroot jail.


6

Because, in most instances, a root process can easily exit the chroot. This is by design, as chroot was never intended as a security device. Alan Cox somewhat famously berated a developer that submitted a kernel patch to "fix" this behavior, claiming that chroot has been abused as a security device, but was never intended to be one.


6

sshd has a certain level of paranoia when it comes to chroot directories. I do not think this can be disabled (even with StrictModes no). The chroot directory and all parent directories must be properly set: The chroot directory and all of its parents must not have group or world write capabilities (ie chmod 755) The chroot directory and all of its ...


6

An sftp solution would also require an ssh login for everyone, so you haven't really lost anything here. Granting ssh access does not necessarily imply full shell access, for example, this shows how to use the ssh authorized_keys file to allow backup via rsync while limiting available commands to just the rsync receiver. In fact, if you opt for key based ...


6

I just had to setup one user who would be able to log in via ssh and the ssh to another server (which is not directly connected to the outside world). The links by cstamas and ericmayo were a good start. Basically, I added the following to /etc/ssh/sshd_config: Match User myuser ChrootDirectory /chroot/myuser From there on, I just had to create the ...


6

What you want is not actually a chroot. You want the DefaultRoot setting in ProFTPd. You can set that in Virtualmin by browsing to Webmin>Servers>ProFTPd Server>Files and Directories, and set the option labeled "Limit users to directories" to "Home directory". Save it, and click "Apply changes" in the upper right corner.


6

If you have a program that require a set/versions of libraries which is different from what is installed on your system, that would be a good candidate for a "chrooted" install. chroot is also handy for installing different version of Linux distribution inside their own environment, without using a VM or emulator (Setting up a Debian chroot under Red Hat).


6

No, chrooting isn't standard practice with Apache. I wouldn't consider it necessary either. However, chuser and chgroup are-- you shouldn't run Apache as root. Doing all three is common with BIND. You should default to running with least privileges necessary with all daemons and all cases. It's arguable that chrooting is pointless in a lot of cases as ...


6

The 'match' feature in sshd_config allows you to specify rules based on group membership or username. Match user joe ChrootDirectory /storage/public ForceCommand /usr/libexec/sftp-server


5

Chrooting is a good security measure, it limits the possibilities to compromise the system in case of a successfull exploit but there are also ways in some case to evade from a chroot, so it is not a definitive way to protect the system. I'm not aware of any disavantage regarding performance and scalability. Concerning database access, it is generaly done ...


5

In general, you might want to use chroot for several reasons: need for another distribution/architecture/distribution version without wanting to use OpenVZ or a virtual machine. For example, I use chroots to have both i386 and amd64 compilation environments on an amd64 machine. restricting access to the system to users. For example, you can use chroot ...


5

Chroot provides a small bit of security to provide a speed-bump for an attacker. If you have a vulnerability in apache/CGIs, an attacker has to escape the chroot jail. Automated attacks are less likely to try to do this, but if there is a known kernel exploit and the requirements for that exploit are obtainable in the chrooted environment, you are hosed. ...


5

The only method I can think of is used of a bind mount. A quick google found http://docs.1h.com/Bind_mounts


5

Yes, as Christopher said, a bind mount will work. But I think it will work only with directories and not at file level. If you need file links you can use hard links but it will only work within a Linux ext filesystem (don't know if other fs support it) See Here for a description of the difference between hard and soft links.


5

Chroot sets the 'root' directory - you cannot navigate above the root directory. Chdir simply changes the starting directory - it is still possible to navigate to other directories (including those above this). If you don't specify a chroot path, then the 'real' root applies - and you specify an absolute chdir. If you do specify a chroot path, then you ...


5

You can use also the statement "exec" if you can't find any other way. exec { "hardlink1": command => "ln target source", path => "/usr/local/bin:/bin", creates => "yourhardlink" }


5

To properly chroot an sftponly group member, you need to set this options in /etc/ssh/sshd_config: Subsystem sftp internal-sftp Match Group sftponly ChrootDirectory /srv/chroot/%u ForceCommand internal-sftp It is a requirement that the home directory, and the directories all the way up to the root of the system, of chrooted users ...



Only top voted, non community-wiki answers of a minimum length are eligible