Tag Info

Hot answers tagged

22

Why, hello there Lars! That's a fascinating question you've asked, and after some research I may have found an answer for you. According to this and other posts out there, it may be possible to set the VFCF_JAIL attribute on the NFS filesystem provider, which would in theory allow jails to perform NFS mounts. This may, in turn, allow one to run amd inside ...


11

Ok, you're using kind of a weird setup, but just in general: First off, linux doesn't support true (bsd style) jails (unless you install openvz or vserver), but setting everything to run as a non priviledged user + chroots can very seriously improve security. Running things as a non-root user is essential, chroots are just an (arguably sizable) stumbling ...


8

Symlinks are purely symbolic: they contain nothing but a path, so when you open a symlink, the OS reads the path and uses that instead. In a chroot environment, links (especially ones with absolute paths) typically don't point to the same place they pointed to in the normal environment. If the server OS is Linux, your best bet is to bind-mount the entire ...


7

Here's an Ubuntu page that shows that you can run in under KVM - https://help.ubuntu.com/community/LXC --additional info-- I've just completed live implementation of LXC under VMware VSphere, as part of it I did a couple of Proof of Concepts that implemented LXC under KVM and VirtualBox as well here's the link: ...


7

chrooting users using ssh is not a desirable configuration in most cases. When they're jailed into their home dir, they won't be able to use any programs outside their home dir. This makes unix almost unusable as a shell server. You can use FTPS instead of SFTP/SCP, which will send passwords over SSL, but uses an ssh server, allowing you to chroot them for ...


5

OpenSSH (which also provides sftp and scp functionality) has gained chroot functionality in its later versions. Basically you just need to add lines similar to these one to your /etc/ssh/sshd_config file. Subsystem sftp internal-sftp Match group sftpusers ChrootDirectory /var/www/xy/backup/files/ X11Forwarding no AllowTcpForwarding no ...


4

You cannot symlink to anything that is not inside the chroot'ed environment. I would suggest doing a mount --bind: (assuming the user's chroot directory is /home/john mount --bind /tmp/john /home/john/tmp/john mount --bind /srv/www/john /home/john/srv/www/john


4

Don't bother with rssh and creating jails if all you need is sftp. Recent versions of openssh-server can chroot sftp users for you if you are using the internel sftp server. If, for instance, you want to chroot all users of a certain group to their home directories, you can add this to sshd_config: Match Group sftp-only ChrootDirectory %h ...


4

Depending on what service you want people to connect to in the jail, you can either use firewall rules to forward incoming public traffic on public ports to the appropriate port on the jail's private IP, or you can set up a proxy that will do the job for you -- and incidentally add some protection to your jail. I do this regularly for jails that run web ...


4

After poking around a little bit, it turns out that recent version of ezjail already have this support. The key parts are the following configuration options in /usr/local/etc/ezjail.conf: ezjail_use_zfs="YES" ezjail_jailzfs="tank/jails" And using -c zfs when creating a jail, like this: ezjail-admin create -c zfs myjail 192.168.1.10 You associate ZFS ...


3

How is your disk partitioned? If /var is closer to the centre of the platters than /usr, it will be quicker for the disk to perform seek operations under /var than under /usr; whether that alone is causing the performance loss, is debatable. As for improving performance again, I'm not sure - is there anything else on /var you could move away to make room ...


3

map $remote_user $profile_directory { default $remote_user; '' guests; pavel admins; ivan admins; } server { location /profile/ { alias /path/to/www/$profile_directory/; ... } } http://nginx.org/en/docs/http/ngx_http_core_module.html#variables http://nginx.org/r/map ...


3

Jail term comes from FreeBSD world and refers to more strict way of limiting user access to the system, altough chroot exists in FreeBSD as a separate mechanism. It is something like (sorted by the level of separation): Chroot < OS-level virtualization: (FreeBSD's Jail ≤ Linux OpenVZ) < Paravirtualization: XEN


3

I think what you want here, is to bind mount the target directory inside the jail of the user. You can't symlink out of a jail. Look at this, for instance: mount --bind /media/sdb2/mydocs/archive /home/username/archive


3

nginx needs root to bind to port 80 as master process. Its worker processes then run at different user (based on configuration). To make chrooted nginx and php-fpm play nice is not that difficult - just make sure nginx has a way to access php-fpm (using tcp is easiest) and make sure it passes correct path to php-fpm (relative to chrooted php-fpm, of ...


3

scponly is a hack. The built-in sftp-server with chroot was meant to address this need properly. Ben, why do you want them to see their home as /home/user? Doesn't that kind of defeat the purpose of a chroot? Is it just pwd output that you're looking for to reflect their location? Or is it so they can use full paths in a script? I think you could ...


3

If they already have unjailed ssh access then there would be nothing to gain by restricting sftp even if you could do it. Sure, there was a good reason to chroot the ftp server, but If I already have ssh access to the full machine there's no added security risk to me having sftp access.


3

chroots ONLY change the visible root of the filesystem for child-processes of the chroot-ing command. Everything else - sending signals, manipulating the kernel, etc- is unaffected. It quite simple to leave the chroot again, if it is the only security you have in place. Take a look at LXC, Linux-VServer or OpenVZ for proper containers in Linux, that do ...


2

You should confirm that the password set correctly by either manually copying the files in as Robert Novak suggests, or login to the jail with jexec ${jailID} /bin/tcsh and passwd (you can use jls to find out the jail ID). Also, verify that PermitRootLogin yes in /etc/ssh/sshd_config. EDIT: After you edit or copy /etc/master.passwd, you need to run ...


2

From the sshd_config(5) man page: ChrootDirectory Specifies a path to chroot(2) to after authentication. This path, and all its components, must be root-owned directories that are not writable by any other user or group. You need to turn off the group-write bit.


2

As I see it both a mount --bind of a directory and a hard link of a file share the same security problem: files in the chroot end up being the same (that is, pointing to the same inode) than files outside the chroot. So if the chroot user finds a way to modify these files inside the chroot they've essentially found a way to modify your files. This may or ...


2

By default, in the base system, ssh will listen on all interfaces, port 22. In a default jail install, sshd will listen on all interfaces (specified in your jailed rc.conf), port 22. Since the base system sshd is already listening on these addresses the jailed sshd won't be able to bind to them. What this means in practical terms is that when you are trying ...


2

Chroot sets / to be that directory. The users home directory is apparently set to /var/www/websites/site1 so when WinSCP logs in, it tries to start in the user's home directory which on the actual system would be /vhosts/wild.domain.com/var/www/websites/site1 Presuming this stefanos user only accesses the system through sftp, it would be safe to set the ...


2

By default FTP uses so called 'Active' mode for data transfer which is not very firewall friendly. In this mode FTP server connects to IP:port specified in PORT command sent by client (82.103.140.25:58627 in your case). Simplest way to fix this is to switch from 'Active' to 'Passive' FTP transfer mode. In case of 'pkg_add', which uses fetch(1) for file ...


2

The solution should have been obvious from the problem that the address translation was always occurring before state rules were checked. The address translation needs to be split. The corrected version of the rules found above is: add 00050 divert natd ip4 from any to any via wan0 in add 00060 check-state # Talking to myself add 00200 allow ip from me to ...


2

FreeBSD comes with great handbook. Really must read, dude. For e. g., its chapter 16 describes Jails in depth. UPDATE: Yes, you can use the same IP for Jail as non-jailed processes use, but of course, they can't bind the same IP:Ports, as it usually got used to be.


2

I would say that "jail" is a general term while "chroot" is not. chroot is just one of several possibilities to limit a process's accesses. I have never heard of "jail" in another context though. You may use AppArmor, SELinux and the like to reach similar results but "AppArmor jail" seems to be an uncommon term. On the other hand security is not the only ...


2

It could done in multiple ways. If this is only specific to git, you can install gitolite and you could do all ACL stuff from the gitolite-admin repo. Setup a SFTP jailed root setup using SSH. You can control each and every binary that you could like users to use. groupadd sftpusers useradd -g sftpusers -d /jailed netusers Modify SSHD file Subsystem ...


2

I'm going to suggest an alternate thing since you're focused on authentication and pull: git served over HTTPS with basic authentication. By restricting to HTTPS, you're preventing plaintext disclosure of passwords. See http://maymay.net/blog/2008/08/08/how-to-use-http-basic-authentication-with-git/ for more, and just add basic SSL setup from any other ...


1

LDAP or NIS is the Right Solution -- it's really not that complicated, and you should take a day and learn both (figure about half a day each to get the basics. Less if you buy the O'Reilly NIS book & LDAP book. The big advantage here is you can centralize some accounts (administrative access/support users), authorize others on a per-jail basis, and ...



Only top voted, non community-wiki answers of a minimum length are eligible