Jail ssh - chroot with home mounted ?

system · April 21, 2006, 10:37am

Hello,

If I not wrong in the last version of interworx-cp-install you set by default the installation of the jailed ssh. You don’t perform this task when home is a partition which is mounted.

So is it possible to set the jail ssh if home is a partition ?

Pascal

IWorx-Socheat · April 21, 2006, 3:09pm

Hi Pascal,

Here is the process:

service iworx stop
service httpd stop
you may need to stop other services, do an ‘lsof /home’ to determinen what’s using /home
cd /
umount /home
confirm /home is umounted and empty. If it is, go ahead rmdir /home
edit /etc/fstab to change the mount point of the partition to /chroot instead of /home (you may want to change the label of the partition using e2label to stay consistent with the other partitions)
mkdir /chroot
mount /chroot
mkdir /chroot/home
ln -fs /chroot/home /home
cd /chroot
mv * home
mv home/aquota.* /chroot
chmod 755 /chroot
chmod 711 /chroot/home

That should do it. Hope that helps!
Socheat

system · April 21, 2006, 4:27pm

Hi Socheat,

it’s exactly what I was looking for

Thanks

Pascal

system · May 5, 2006, 8:48pm

Hello

When I connect whit a siteworx account to my box with the jail ssh setup I have this

Last login: Sat May 6 05:40:11 2006 from xxe-01-111-08-19.w81-3.abo.1.fr
id: cannot find name for group ID 574
id: cannot find name for user ID 574
[I have no name!@obiwan ~]$

Why is there this id: cannot find name ? and have “I have no name!”

is it normal ?

Also is it absolutly necesseray to have /chroot set with a chmod to 755 ? 711 wouldn’t be fine ?

And finally, on my other box (with home not mounted) I have done this

mkdir /chroot
mv /home /chroot/
ln -sf /chroot/home /home
chmod 755 /chroot
chmod 711 /chroot/home

Then I have changed one siteworx to allow it to connect with /usr/sbin/jk_chrootsh

But when I connect with this user I’m disconnect immediatly after the password

here is the log in /var/log/message, nothing special

May 6 06:14:26 padawan sshd(pam_unix)[6032]: session opened for user carathos by (uid=0)
May 6 06:14:27 padawan jk_chrootsh[6033]: now entering jail /chroot for user carathos (500)
May 6 06:14:27 padawan sshd(pam_unix)[6032]: session closed for user carathos

Do you know why ? what I have to check ?

Pascal

system · May 5, 2006, 10:15pm

711 is should be fine Pascal, IIRC I did the same on a box a while back but the drawback is that your users will NOT be able to go that far down the directory tree which is pribably what you want anyway

As for the [I have no name!@obiwan ~]$

I suspect if you type #hostname you will get I have no name

The hostname can be changed via

if you don’t already know how (though I suspect you do)

Take a look at /etc/passwd and /etc/group to see if the user obiwan is really user and group 574

The rest of it “looks” right to me but I’ll leave that to Socheat

system · May 6, 2006, 6:43am

711 is should be fine Pascal, IIRC I did the same on a box a while back but the drawback is that your users will NOT be able to go that far down the directory tree which is pribably what you want anyway

exactly, it is what I want

As for the [I have no name!@obiwan ~]$

I suspect if you type hostname you will get I have no name

The hostname can be changed via

if you don’t already know how (though I suspect you do)

Tim, it is not the hostname but the name of the user. Hostname is well shown, it is obiwan
For exemple
[root@obiwan html]# the user is root and the hostname is obiwan and the current dir is html. What is not shown well a user log in using jail ssh is their user name

Take a look at /etc/passwd and /etc/group to see if the user obiwan is really user and group 574

Obiwan is not a user but the hostname and yes the user carathos have the id 574

The rest of it “looks” right to me but I’ll leave that to Socheat

Cool

Pascal

system · May 6, 2006, 7:09am

Hello,

And finally, on my other box (with home not mounted) I have done this

mkdir /chroot
mv /home /chroot/
ln -sf /chroot/home /home
chmod 755 /chroot
chmod 711 /chroot/home

Then I have changed one siteworx to allow it to connect with /usr/sbin/jk_chrootsh

But when I connect with this user I’m disconnect immediatly after the password

I find why but not sure why it occurs

[root@padawan root]# su carathos
/bin/bash: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory

I first login as root then su carathos (the user with jk_chrootsh)

The libc.so.6 is here

/lib/i686/libc.so.6
/lib/libc.so.6
/lib/tls.disabled/libc.so.6
/lib/tls.disabled-2005-07-28-02-07-1122508852/libc.so.6
/lib/tls.disabled-2005-11-09-09-11-1131526544/libc.so.6

Don’t ask me why /lib/tls is /lib/tls.disabled/ I don’t know :-p

Pascal

IWorx-Socheat · May 6, 2006, 7:14am

Hi Pascal,

Actually, the passwd file you should be checking for is /chroot/etc/passwd. Make sure the /chroot/etc/passwd entry for that user is identical to the entry in /etc/passwd, including uid and gids.

Socheat

system · May 6, 2006, 7:30am

Hi*

What I do not understand is in the strace it founds the libc.so file. There is a lot of bad descriptor when it searche for the rlimit, but not sure it is related.

Here is the strace output of the su carathos command.

Hope it might help

Pascal

su.txt (36.1 KB)

IWorx-Socheat · May 6, 2006, 8:48am

Hi Pascal,

Please open a ticket, we’ll check it out.

Socheat

system · May 6, 2006, 12:34pm

slaps forehead

I should have known that

system · May 6, 2006, 12:37pm

Whoops! You’re right. I don’t know what I was thinking

system · May 6, 2006, 1:38pm

Lol no pbm Tim

I have opened a ticket

Pascal