Tag Info

Hot answers tagged

23

Why, hello there Lars! That's a fascinating question you've asked, and after some research I may have found an answer for you. According to this and other posts out there, it may be possible to set the VFCF_JAIL attribute on the NFS filesystem provider, which would in theory allow jails to perform NFS mounts. This may, in turn, allow one to run amd inside ...


13

Symlinks are purely symbolic: they contain nothing but a path, so when you open a symlink, the OS reads the path and uses that instead. In a chroot environment, links (especially ones with absolute paths) typically don't point to the same place they pointed to in the normal environment. If the server OS is Linux, your best bet is to bind-mount the entire ...


11

Ok, you're using kind of a weird setup, but just in general: First off, linux doesn't support true (bsd style) jails (unless you install openvz or vserver), but setting everything to run as a non priviledged user + chroots can very seriously improve security. Running things as a non-root user is essential, chroots are just an (arguably sizable) stumbling ...


7

Here's an Ubuntu page that shows that you can run in under KVM - https://help.ubuntu.com/community/LXC --additional info-- I've just completed live implementation of LXC under VMware VSphere, as part of it I did a couple of Proof of Concepts that implemented LXC under KVM and VirtualBox as well here's the link: ...


7

chrooting users using ssh is not a desirable configuration in most cases. When they're jailed into their home dir, they won't be able to use any programs outside their home dir. This makes unix almost unusable as a shell server. You can use FTPS instead of SFTP/SCP, which will send passwords over SSL, but uses an ssh server, allowing you to chroot them for ...


6

OpenSSH (which also provides sftp and scp functionality) has gained chroot functionality in its later versions. Basically you just need to add lines similar to these one to your /etc/ssh/sshd_config file. Subsystem sftp internal-sftp Match group sftpusers ChrootDirectory /var/www/xy/backup/files/ X11Forwarding no AllowTcpForwarding no ...


5

Don't bother with rssh and creating jails if all you need is sftp. Recent versions of openssh-server can chroot sftp users for you if you are using the internel sftp server. If, for instance, you want to chroot all users of a certain group to their home directories, you can add this to sshd_config: Match Group sftp-only ChrootDirectory %h ...


5

According to the Manual 8 0 "Every .conf file can be overridden with a file named .local. The .conf file is read first, then .local, with later settings overriding earlier ones. Thus, a .local file doesn't have to include everything in the corresponding .conf file, only those settings that you wish to override. Modifications should take place in the .local ...


4

If you can limit them to just SFTP and not allowing them to login via ssh, then you can use the chroot facilities built into openssh. here is a good article explaining how


4

You'll want to add an entry to /etc/rc.conf to ensure the alias is recreated on reboot. Also, you might consider using ezjail.


4

Depending on what service you want people to connect to in the jail, you can either use firewall rules to forward incoming public traffic on public ports to the appropriate port on the jail's private IP, or you can set up a proxy that will do the job for you -- and incidentally add some protection to your jail. I do this regularly for jails that run web ...


4

After poking around a little bit, it turns out that recent version of ezjail already have this support. The key parts are the following configuration options in /usr/local/etc/ezjail.conf: ezjail_use_zfs="YES" ezjail_jailzfs="tank/jails" And using -c zfs when creating a jail, like this: ezjail-admin create -c zfs myjail 192.168.1.10 You associate ZFS ...


4

You cannot symlink to anything that is not inside the chroot'ed environment. I would suggest doing a mount --bind: (assuming the user's chroot directory is /home/john mount --bind /tmp/john /home/john/tmp/john mount --bind /srv/www/john /home/john/srv/www/john


4

First run jls to find out needed jail ID, than jexec ${jailID} /bin/tcsh (${jailID} is an ID of your jail)


3

scponly is a hack. The built-in sftp-server with chroot was meant to address this need properly. Ben, why do you want them to see their home as /home/user? Doesn't that kind of defeat the purpose of a chroot? Is it just pwd output that you're looking for to reflect their location? Or is it so they can use full paths in a script? I think you could ...


3

If they already have unjailed ssh access then there would be nothing to gain by restricting sftp even if you could do it. Sure, there was a good reason to chroot the ftp server, but If I already have ssh access to the full machine there's no added security risk to me having sftp access.


3

nginx needs root to bind to port 80 as master process. Its worker processes then run at different user (based on configuration). To make chrooted nginx and php-fpm play nice is not that difficult - just make sure nginx has a way to access php-fpm (using tcp is easiest) and make sure it passes correct path to php-fpm (relative to chrooted php-fpm, of ...


3

map $remote_user $profile_directory { default $remote_user; '' guests; pavel admins; ivan admins; } server { location /profile/ { alias /path/to/www/$profile_directory/; ... } } http://nginx.org/en/docs/http/ngx_http_core_module.html#variables http://nginx.org/r/map ...


3

How is your disk partitioned? If /var is closer to the centre of the platters than /usr, it will be quicker for the disk to perform seek operations under /var than under /usr; whether that alone is causing the performance loss, is debatable. As for improving performance again, I'm not sure - is there anything else on /var you could move away to make room ...


3

chroots ONLY change the visible root of the filesystem for child-processes of the chroot-ing command. Everything else - sending signals, manipulating the kernel, etc- is unaffected. It quite simple to leave the chroot again, if it is the only security you have in place. Take a look at LXC, Linux-VServer or OpenVZ for proper containers in Linux, that do ...


3

Looking at my /etc/fail2ban/jail.local there is this comment: Since 0.8.1 upstream fail2ban uses sendmail MTA for the mailing. Change mta configuration parameter to mail if you want to revert to conventional 'mail' Based on this and the error you posted, it seems you can only specify sendmail or mail. Do you receive emails from fail2ban when mta is set ...


3

Jail term comes from FreeBSD world and refers to more strict way of limiting user access to the system, altough chroot exists in FreeBSD as a separate mechanism. It is something like (sorted by the level of separation): Chroot < OS-level virtualization: (FreeBSD's Jail ≤ Linux OpenVZ) < Paravirtualization: XEN


3

I think what you want here, is to bind mount the target directory inside the jail of the user. You can't symlink out of a jail. Look at this, for instance: mount --bind /media/sdb2/mydocs/archive /home/username/archive


2

You need to add: passwd_chroot_enable=YES From the man page: passwd_chroot_enable If enabled, along with chroot_local_user , then a chroot() jail location may be specified on a per-user basis. Each user's jail is derived from their home directory string in /etc/passwd.


2

The solution should have been obvious from the problem that the address translation was always occurring before state rules were checked. The address translation needs to be split. The corrected version of the rules found above is: add 00050 divert natd ip4 from any to any via wan0 in add 00060 check-state # Talking to myself add 00200 allow ip from me to ...


2

FreeBSD comes with great handbook. Really must read, dude. For e. g., its chapter 16 describes Jails in depth. UPDATE: Yes, you can use the same IP for Jail as non-jailed processes use, but of course, they can't bind the same IP:Ports, as it usually got used to be.


2

I would say that "jail" is a general term while "chroot" is not. chroot is just one of several possibilities to limit a process's accesses. I have never heard of "jail" in another context though. You may use AppArmor, SELinux and the like to reach similar results but "AppArmor jail" seems to be an uncommon term. On the other hand security is not the only ...


2

It could done in multiple ways. If this is only specific to git, you can install gitolite and you could do all ACL stuff from the gitolite-admin repo. Setup a SFTP jailed root setup using SSH. You can control each and every binary that you could like users to use. groupadd sftpusers useradd -g sftpusers -d /jailed netusers Modify SSHD file Subsystem ...


2

I'm going to suggest an alternate thing since you're focused on authentication and pull: git served over HTTPS with basic authentication. By restricting to HTTPS, you're preventing plaintext disclosure of passwords. See http://maymay.net/blog/2008/08/08/how-to-use-http-basic-authentication-with-git/ for more, and just add basic SSL setup from any other ...


2

From the sshd_config(5) man page: ChrootDirectory Specifies a path to chroot(2) to after authentication. This path, and all its components, must be root-owned directories that are not writable by any other user or group. You need to turn off the group-write bit.



Only top voted, non community-wiki answers of a minimum length are eligible