Questions tagged [chroot]
A chroot on Unix operating systems is an operation that changes the apparent root directory for the current running process and its children.
403
questions
0
votes
0answers
24 views
Allow SFTP access to one or several directories for several users
For some of my users, I need to allow them SFTP access to one or several directories.
Multiple users can have access to the same directory.
But for directories they don't have permission for, they can'...
0
votes
1answer
43 views
Is there another way to restrict SSH user other than chroot jail?
I need to create a safe environment for a foreign SSH user that has to have very restricted access to our server. That is:
can only execute commands that are allowed
can only use specific software ...
-1
votes
0answers
36 views
How to create an ec2 user when the volume is mounted in another instance [closed]
I have mounted a root volume of an instance (let's say server 1) in another instance(server 2). Now I want to create a new user in server 1 without login into it. Is there a way to do it from server 2....
1
vote
1answer
119 views
chroot not able to start service - not found. What is missing?
I would like to run a service inside a chroot in a NetBSD 9.1 amd64 system.
The service runs if invoked from OS.
The service in question is dendrite-monolith-server. I just copied the file for ease ...
0
votes
1answer
34 views
sftp with Jailkit Connecting to host failed (exit status 4)
I'm running Ubuntu Server 18.04 with Jailkit 2.21, wanting to allow chrooted scp/sftp access via password to some users.
The sftp client can authenticate OK, but then just disconnects with a "...
0
votes
0answers
46 views
how to set up apparmor for Bind in Ubuntu 20.04
Apparmor has caused a lot of headache to me today before I could even realize it was apparmor preventing Bind to start normally.
I have disabled it and rebooted my server and Bind seems to work just ...
0
votes
0answers
14 views
SFTP Chroot with ability to create directories
I chrooted some Debian users by adding them into sftp_users group and setting this into sshd config:
Match Group sftp_users
X11Forwarding no
AllowTcpForwarding no
ChrootDirectory %h
...
0
votes
1answer
28 views
df shows low disk space. It includes a directory which uses mount --bind for chroot sftp
I've setup a chroot environment for sftp access (sftp only, no shell).
The sftp user needs rw access to a host directory. I mounted it via /etc/fstab
/var/www/html /home/sftp-user/jail/html none ...
0
votes
0answers
20 views
Multiple ftp jails per user
I would like to give users access to directories via SFTP/FTPS. The access should be dependent on the group and each group should have a directory. It may be that users are in several groups. So there ...
1
vote
0answers
104 views
Annoying sftp chroot again (Ubuntu 20.04)
I think I understand all of the moving parts of not allowing a chrooted user over sftp to write to their own home directory (/home/username), but instead to write to an enclosed directory (/home/...
0
votes
1answer
145 views
SFTP Chroot write in chrooted /
Hey,
I'd like to write with the chrooted user in his / but i can't.
Example: i have /home/sftponly/ as ChrootDirectory
Inside has to be another Directory with Permissions to this User, otherwise i ...
0
votes
0answers
24 views
Use pam_mkhomedir with chroot
I build a sshd server, users will be able to connect on it and then ssh others servers. I connected my server to our LDAP and enable pam_mkhomedir. It works like a charm, ex: /home/test.
But when I ...
1
vote
2answers
476 views
OpenSSH + Active Directory: allow sftp for a group while disallowing everyone else
My objective is to allow a given Active Directory group members to use OpenSSH SFTP in chroot, and deny access to SSH for them and all others that aren't members of that group, while still allowing ...
1
vote
1answer
124 views
Performing an OpenSCAP Remediation via a chroot session — “Can't perform remediation in offline mode” Error
I am attempting to perform an OpenSCAP remediation through a chroot session. My command is structured as follows:
oscap-chroot /mnt/chroot_fs \
xccdf eval \
--remediate \
--...
0
votes
0answers
21 views
SFTP chroote wont work with Active directory users/groups
I' have try many different configs to solve the problem, but unsuccessfully to make this config work out.
I use sssd to authenticate my users on Active directory and I need to configure an sftp server ...
0
votes
1answer
48 views
restrict access .ssh folder from the connected user
In complex setup where user connected to remote host using authorized private key, there is a .ssh folder with user settings and keys related to the remote host.
Is it possible to disallow the ...
0
votes
1answer
513 views
php exec returning 127 because /bin/sh is getting “Permission denied” in apache chroot
I have a php script that is trying to use exec (or shell_exec) to execute a binary on the system. The exec is failing with return code 127.
Return code 127 normally means command not found. So I made ...
0
votes
1answer
332 views
VSFTPD: set a user's default directory to NOT their chroot directory
I have a VSFTPD setup in which users are chrooted to their home directories. Standard stuff. But this requires all of their home directories to be unwritable to them (to avoid security issues.) No ...
1
vote
0answers
31 views
Install Linux on a second disk from an already running Linux (RHEL 7.8) instance
I am trying to mount a second disk on a running Linux (RHEL 7.8) AWS instance, install a customized bootable Linux environment to it, and then change that disk to an AMI so we can boot new Linux ...
0
votes
1answer
18 views
Configure multi-level sftp access
I'm setting up a sftp server where clients will only have read-only access. They will log into their chroot directories, which is fine, but I need an admin account that can access/write to those ...
1
vote
1answer
240 views
How to specify user home in sshd config?
I have my sftp users chrooted into /var/www and I would like for them to be automatically moved into their directory. I found this answer which helped me a lot: Chroot SFTP - Possible to allow user to ...
0
votes
1answer
337 views
AWS EC2 Linux restrict SFTP user to their home directory when users connect from WinSCP
I'm working on a solution to restrict the user to the home directory or a specific directory.
I need to restrict a user for below scenario,
we have multiple Wordpress installation in webroot /var/www/...
0
votes
1answer
128 views
PHP-FPM chroot - one pool for all nginx virtualhosts
Now we have multiple virtualhots (nginx) under one php-fpm pool. We would like to use it same way with chroot.
Chroot directive is absolute path /var/www, but chdir should be /[domain]/httpdocs
Is it ...
0
votes
0answers
16 views
Setting up account to upload to a website subdirectory
I need to setup a stfp account on Ubuntu 18.04 that meets the following requirement:
Can upload to subfolder of website i.e. example.com/subfolder/
Uploaded files belong to www-data group so are ...
2
votes
0answers
167 views
Setting up virtual users with vsftpd
I'm trying to set up virtual users for an FTP server in a Linux box, but I'm not sure if the server I've picked up (vsftpd) can do what I need. My requirements are:
The FTP accounts are inside a ...
1
vote
0answers
45 views
KSH/Bash History for jailed SSH users
How can I keep a history of activities for chroot'd SSH (not SFTP) users?
I've tried:
created a .sh_history in their home with the proper permissions
created a custom $HISTFILE in .profile and in its ...
0
votes
0answers
563 views
Running docker from within a chroot
I am trying to build a distro for RaspberryPi which ships with an aarch64 chroot running docker.
For this to work, I need docker to run within a chroot.
I am basing of rasbian, which is distributed ...
0
votes
1answer
182 views
Why does internal-sftp verbose logging not include rename, move and delete operations?
I have configured a CentOS 7.7 installation to use the internal-sftp subsystem and to chroot a specific user in to a particular folder. I want to enable logging, so I configured sshd like this:
...
1
vote
1answer
729 views
Restricting SFTP users (OpenSSH-based) to a custom port only
I understand that there have been tons of other threads on the Internet on allowing OpenSSH SFTP connections on a custom port. I've hit them, not all, but a lot. And have not been able to make it work ...
0
votes
0answers
111 views
Allow SCP/SSH to a chrooted environment only?
Is there a way to do this without installing a package like rssh or scponly, as they seem woefully out of date and full of security problems?
Is there any newer tool I could use? ssh is an optional ...
1
vote
1answer
73 views
Chrooted SFTP user can't login
I'm trying to configure a user who will only be able to access to an specific directory. I've configured a Chroot jail in SSH and changed its home directory, but configuring the internal-sftp with ...
0
votes
1answer
794 views
Execute half of the %post section of a kickstart in a nochroot environment and the other half in a chroot environment
I am trying to execute a script that performs certain security configurations on my recently installed system. Much of the script refers to files starting with / as the base directory which presents ...
1
vote
0answers
121 views
How do I remove a kernel package from an image chroot if it's the kernel running on my build host?
I am trying to build a custom image using diskimage-builder, and amongst other things, that tool updates all the packages within the image to the latest version, including the kernel. It also uses ...
0
votes
1answer
488 views
LocalForwarding on a SSH connection from my desktop client to a CHROOTED user in an LXD container
I currently have a proxified web host setup for local development, yet I'm trying to make it a proper (documented) setup so I can deploy it on practically any VPS hosting.
Currently everything else ...
1
vote
2answers
498 views
Configure cron jobs for the chrooted user
I've configured chrooted SSH user on CentOS 7. Mounted /proc, /dev, /dev/pts to the user and installed required packages. And now I want to allow cron jobs for this user. How can I solve the task?
...
1
vote
0answers
501 views
Ubuntu root password reset
I have a dedicated server that i've just setup at Hetzner. I've done the stupid thing of not changing the temp password they give you and disconnected from the SSH session. They don't send nor store ...
0
votes
0answers
178 views
Issue Hardlink/Junction not working when chroot all users to c:/share dir in Windows OpenSSH Server 2019
Issue Hardlink/Junction not working when chroot all users to c:/share dir in Windows OpenSSH Server 2019.
Link Created
mklink /d E "E:"
mklink /d F "F:"
Entry in sshd_config file
ChrootDirectory c:/...
1
vote
1answer
126 views
Jailkit/Chroot - Allow Less and More
I have the need to add the LESS and MORE commands to a jailed-user. I've attempted the following and can't quite get it to work:
# which less;which more
/usr/bin/less /usr/bin/more
Now that I ...
0
votes
1answer
457 views
Publish network services using Systemd machinectl
TL;DR: How to expose network services to the host through machinectl/nspawn containers?
I'm trying to make things perfectfor my setup, i.e. installing my services in separated chroot instances.
To ...
3
votes
1answer
3k views
chroot, gpg-agent, and Ubuntu 18.04
For SFTP access to my server, I have created a sftp user that is limited to a working directory by chroot.
Match User sftp-user
AuthorizedKeysFile /home/sftp-user/.ssh/authorized_keys
...
0
votes
1answer
535 views
vsftpd with chroot_local_user requires client certificate
When setting up my FTPS server I want to enable chroot_local_user. When disabled everything works fine. If I enable this however, WinSCP fails to connect and claims I need a client certificate to ...
2
votes
0answers
134 views
internal-sftp on chroot jail disconnects with status 1?
Server: Ubuntu 18.04.1 LTS
SSHD: OpenSSH_7.6p1 Ubuntu-4, OpenSSL 1.0.2n
I have created a test user sftpuser and sftp group to try logging in through a WinSCP client, as a start. In sshd_config I ...
0
votes
1answer
130 views
OpenSSL-related linker error while building PHP 5.3.3
While trying to build PHP 5.3.3 on Debian jessie (save yourself some sanity by not asking why) with OpenSSL extension enabled, I encountered undefined reference to symbol 'X509_free@@OPENSSL_1.0.0' in ...
0
votes
0answers
618 views
Segmentation fault when building centos 5 chroot
For some legacy application I decided to use chroot with CentOS 5.
I did install CentOS 5 on virtual machine, then I boot virtual machine with live CD and using tar, I "copied" the files from the ...
0
votes
1answer
705 views
mariadb in chroot gives Access denied for user 'root'@'localhost' even though password is set
I have a script that runs mariadb in a chroot, its a qemu-arm-static rasoberrypi chroot but I don't that that should change much.
The script installs and then sets the password for mariadb root user, ...
0
votes
1answer
2k views
SFTP client can't write to own home directory when chrooted there
This is a tougher variant of the previous question bad ownership or modes for chroot directory component.
In that other question, we learn that openssh refuses to chroot a user to its own home ...
4
votes
1answer
1k views
Bind mount - different results on CentOS 6 and CentOS 7
I'm mounting couple of directories (bind mount) in a chroot environment, but they behave differently on CentOS 6 and 7 - exactly the same commands.
Example:
I have my chroot env in /chroot/base.
...
2
votes
3answers
11k views
yum/rpm Failed to initialize NSS library in chroot
I am performing a yum update from CentOS 7.4 to CentOS 7.5, when nspr and nss soft-softoken receive the updates, I am left with the following error:
yum update nspr
error: Failed to initialize NSS ...
0
votes
1answer
2k views
How to properly chroot when using key based authentication within openssh-server
I'm running a Debian Stretch x86_64 server, with OpenSSH_7.4p1 Debian-10+deb9u3, OpenSSL 1.0.2l 25 May 2017.
I want to use chroots in combination with OpenSSH server's internal SFTP system. My ...
5
votes
2answers
10k views
Chroot SFTP - Possible to allow user to write to current (chroot) directory
I currently have a WORKING SFTP login, using a private key for login and the user is chroot'ed into their home directory.
Goal: Keep the user chroot but allow WRITE access to the relative chroot ...
