I need to create a chroot jail on my RHEL5 production server to allow a specific user to work with the less right possible, but with GIT.
Here is my system configuration :
- RHEL 5 : Release 5.10
- OpenSSH : OpenSSH_6.4p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
I've created, for testing, a folder /chroot with a subfolder toto where I want to chroot my user.
# ls -la /chroot total 24 drwxr-xr-x 3 root root 4096 Nov 11 15:22 . drwxr-xr-x 31 root root 4096 Nov 12 13:02 .. drwxr-xr-x 5 root root 4096 Nov 11 15:22 toto # ls -la /chroot/toto total 40 drwxr-xr-x 5 root root 4096 Nov 11 15:22 . drwxr-xr-x 3 root root 4096 Nov 11 15:22 .. drwxr-xr-x 2 root root 4096 Nov 11 15:22 bin drwxr-xr-x 2 root root 4096 Nov 11 15:22 lib drwxr-xr-x 5 root root 4096 Nov 11 15:22 usr
I've created a chroot group named chroot_www and added my user toto to it.
I've edited /etc/ssh/sshd_config and added the necessary lines at the end.
#Subsystem sftp /usr/libexec/openssh/sftp-server Subsystem sftp internal-sftp Match Group chroot_www # ForceCommand internal-sftp ChrootDirectory /chroot/toto AllowTcpForwarding no
But when I want to connect with ssh I get this error :
ssh toto@******** toto@********'s password: Last login: Thu Nov 14 13:22:35 2013 from ******** Could not chdir to home directory /chroot/toto: No such file or directory Connection to ******** closed.
but the directory exists, and the rights are good.
And it's strange for two reason :
- I've got the same configuration on a RHEL6 server and it's working.
- I can connect with SFTP and I'm chroot jailed in the right folder, but I can't with SSH.
So I'm really interested if you got experience with chroot jail or problem like this one...