1

I need to create a chroot jail on my RHEL5 production server to allow a specific user to work with the less right possible, but with GIT.

Here is my system configuration :

  • RHEL 5 : Release 5.10
  • OpenSSH : OpenSSH_6.4p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008

I've created, for testing, a folder /chroot with a subfolder toto where I want to chroot my user.

# ls -la /chroot
total 24
drwxr-xr-x  3 root root 4096 Nov 11 15:22 .
drwxr-xr-x 31 root root 4096 Nov 12 13:02 ..
drwxr-xr-x  5 root root 4096 Nov 11 15:22 toto

# ls -la /chroot/toto
total 40
drwxr-xr-x 5 root root 4096 Nov 11 15:22 .
drwxr-xr-x 3 root root 4096 Nov 11 15:22 ..
drwxr-xr-x 2 root root 4096 Nov 11 15:22 bin
drwxr-xr-x 2 root root 4096 Nov 11 15:22 lib
drwxr-xr-x 5 root root 4096 Nov 11 15:22 usr

I've created a chroot group named chroot_www and added my user toto to it.

I've edited /etc/ssh/sshd_config and added the necessary lines at the end.

#Subsystem      sftp    /usr/libexec/openssh/sftp-server

Subsystem sftp internal-sftp
Match Group chroot_www
#       ForceCommand internal-sftp
        ChrootDirectory /chroot/toto
        AllowTcpForwarding no

But when I want to connect with ssh I get this error :

ssh toto@********
toto@********'s password: 
Last login: Thu Nov 14 13:22:35 2013 from ********
Could not chdir to home directory /chroot/toto: No such file or directory
Connection to ******** closed.

but the directory exists, and the rights are good.

And it's strange for two reason :

  • I've got the same configuration on a RHEL6 server and it's working.
  • I can connect with SFTP and I'm chroot jailed in the right folder, but I can't with SSH.

So I'm really interested if you got experience with chroot jail or problem like this one...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.