Tag Info

Hot answers tagged

24

Why, hello there Lars! That's a fascinating question you've asked, and after some research I may have found an answer for you. According to this and other posts out there, it may be possible to set the VFCF_JAIL attribute on the NFS filesystem provider, which would in theory allow jails to perform NFS mounts. This may, in turn, allow one to run amd inside ...


14

Symlinks are purely symbolic: they contain nothing but a path, so when you open a symlink, the OS reads the path and uses that instead. In a chroot environment, links (especially ones with absolute paths) typically don't point to the same place they pointed to in the normal environment. If the server OS is Linux, your best bet is to bind-mount the entire ...


11

Ok, you're using kind of a weird setup, but just in general: First off, linux doesn't support true (bsd style) jails (unless you install openvz or vserver), but setting everything to run as a non priviledged user + chroots can very seriously improve security. Running things as a non-root user is essential, chroots are just an (arguably sizable) stumbling ...


7

Here's an Ubuntu page that shows that you can run in under KVM - https://help.ubuntu.com/community/LXC --additional info-- I've just completed live implementation of LXC under VMware VSphere, as part of it I did a couple of Proof of Concepts that implemented LXC under KVM and VirtualBox as well here's the link: ...


7

chrooting users using ssh is not a desirable configuration in most cases. When they're jailed into their home dir, they won't be able to use any programs outside their home dir. This makes unix almost unusable as a shell server. You can use FTPS instead of SFTP/SCP, which will send passwords over SSL, but uses an ssh server, allowing you to chroot them for ...


6

OpenSSH (which also provides sftp and scp functionality) has gained chroot functionality in its later versions. Basically you just need to add lines similar to these one to your /etc/ssh/sshd_config file. Subsystem sftp internal-sftp Match group sftpusers ChrootDirectory /var/www/xy/backup/files/ X11Forwarding no AllowTcpForwarding no ...


6

According to the Manual 8 0 "Every .conf file can be overridden with a file named .local. The .conf file is read first, then .local, with later settings overriding earlier ones. Thus, a .local file doesn't have to include everything in the corresponding .conf file, only those settings that you wish to override. Modifications should take place in the .local ...


5

Don't bother with rssh and creating jails if all you need is sftp. Recent versions of openssh-server can chroot sftp users for you if you are using the internel sftp server. If, for instance, you want to chroot all users of a certain group to their home directories, you can add this to sshd_config: Match Group sftp-only ChrootDirectory %h ...


5

You cannot symlink to anything that is not inside the chroot'ed environment. I would suggest doing a mount --bind: (assuming the user's chroot directory is /home/john mount --bind /tmp/john /home/john/tmp/john mount --bind /srv/www/john /home/john/srv/www/john


4

First run jls to find out needed jail ID, than jexec ${jailID} /bin/tcsh (${jailID} is an ID of your jail)


4

After poking around a little bit, it turns out that recent version of ezjail already have this support. The key parts are the following configuration options in /usr/local/etc/ezjail.conf: ezjail_use_zfs="YES" ezjail_jailzfs="tank/jails" And using -c zfs when creating a jail, like this: ezjail-admin create -c zfs myjail 192.168.1.10 You associate ZFS ...


4

Depending on what service you want people to connect to in the jail, you can either use firewall rules to forward incoming public traffic on public ports to the appropriate port on the jail's private IP, or you can set up a proxy that will do the job for you -- and incidentally add some protection to your jail. I do this regularly for jails that run web ...


4

If you can limit them to just SFTP and not allowing them to login via ssh, then you can use the chroot facilities built into openssh. here is a good article explaining how


4

You'll want to add an entry to /etc/rc.conf to ensure the alias is recreated on reboot. Also, you might consider using ezjail.


3

chroots ONLY change the visible root of the filesystem for child-processes of the chroot-ing command. Everything else - sending signals, manipulating the kernel, etc- is unaffected. It quite simple to leave the chroot again, if it is the only security you have in place. Take a look at LXC, Linux-VServer or OpenVZ for proper containers in Linux, that do ...


3

If they already have unjailed ssh access then there would be nothing to gain by restricting sftp even if you could do it. Sure, there was a good reason to chroot the ftp server, but If I already have ssh access to the full machine there's no added security risk to me having sftp access.


3

scponly is a hack. The built-in sftp-server with chroot was meant to address this need properly. Ben, why do you want them to see their home as /home/user? Doesn't that kind of defeat the purpose of a chroot? Is it just pwd output that you're looking for to reflect their location? Or is it so they can use full paths in a script? I think you could ...


3

nginx needs root to bind to port 80 as master process. Its worker processes then run at different user (based on configuration). To make chrooted nginx and php-fpm play nice is not that difficult - just make sure nginx has a way to access php-fpm (using tcp is easiest) and make sure it passes correct path to php-fpm (relative to chrooted php-fpm, of ...


3

How is your disk partitioned? If /var is closer to the centre of the platters than /usr, it will be quicker for the disk to perform seek operations under /var than under /usr; whether that alone is causing the performance loss, is debatable. As for improving performance again, I'm not sure - is there anything else on /var you could move away to make room ...


3

map $remote_user $profile_directory { default $remote_user; '' guests; pavel admins; ivan admins; } server { location /profile/ { alias /path/to/www/$profile_directory/; ... } } http://nginx.org/en/docs/http/ngx_http_core_module.html#variables http://nginx.org/r/map ...


3

Jail term comes from FreeBSD world and refers to more strict way of limiting user access to the system, altough chroot exists in FreeBSD as a separate mechanism. It is something like (sorted by the level of separation): Chroot < OS-level virtualization: (FreeBSD's Jail ≤ Linux OpenVZ) < Paravirtualization: XEN


3

I think what you want here, is to bind mount the target directory inside the jail of the user. You can't symlink out of a jail. Look at this, for instance: mount --bind /media/sdb2/mydocs/archive /home/username/archive


3

Looking at my /etc/fail2ban/jail.local there is this comment: Since 0.8.1 upstream fail2ban uses sendmail MTA for the mailing. Change mta configuration parameter to mail if you want to revert to conventional 'mail' Based on this and the error you posted, it seems you can only specify sendmail or mail. Do you receive emails from fail2ban when mta is set ...


2

By default FTP uses so called 'Active' mode for data transfer which is not very firewall friendly. In this mode FTP server connects to IP:port specified in PORT command sent by client (82.103.140.25:58627 in your case). Simplest way to fix this is to switch from 'Active' to 'Passive' FTP transfer mode. In case of 'pkg_add', which uses fetch(1) for file ...


2

You should confirm that the password set correctly by either manually copying the files in as Robert Novak suggests, or login to the jail with jexec ${jailID} /bin/tcsh and passwd (you can use jls to find out the jail ID). Also, verify that PermitRootLogin yes in /etc/ssh/sshd_config. EDIT: After you edit or copy /etc/master.passwd, you need to run ...


2

As I see it both a mount --bind of a directory and a hard link of a file share the same security problem: files in the chroot end up being the same (that is, pointing to the same inode) than files outside the chroot. So if the chroot user finds a way to modify these files inside the chroot they've essentially found a way to modify your files. This may or ...


2

From the sshd_config(5) man page: ChrootDirectory Specifies a path to chroot(2) to after authentication. This path, and all its components, must be root-owned directories that are not writable by any other user or group. You need to turn off the group-write bit.


2

By default, in the base system, ssh will listen on all interfaces, port 22. In a default jail install, sshd will listen on all interfaces (specified in your jailed rc.conf), port 22. Since the base system sshd is already listening on these addresses the jailed sshd won't be able to bind to them. What this means in practical terms is that when you are trying ...


2

You can use sshd configuration to achieve this. Create a user e.g. fred then add the following to your sshd_config file Match user fred ChrootDirectory /var/www/xy/backup/files ForceCommand internal-sftp X11Forwarding no AllowTcpForwarding no This will lock the user fred to the desired directory and it's sub directories. The user fred only ...


2

Chroot sets / to be that directory. The users home directory is apparently set to /var/www/websites/site1 so when WinSCP logs in, it tries to start in the user's home directory which on the actual system would be /vhosts/wild.domain.com/var/www/websites/site1 Presuming this stefanos user only accesses the system through sftp, it would be safe to set the ...



Only top voted, non community-wiki answers of a minimum length are eligible