Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've followed the steps outlined here to create a chrooted sftp environment. Everything works great EXCEPT for the command ls. When I do an ls, with any of the flags, I get disconnected immediately.

When I do an strace on the PID, I get this (couldn't get it looking better than this.

Any ideas? I'm at wits ends.

`Process 7071 attached - interrupt to quit
 select(5, [3], [], NULL, NULL)          = 1 (in [3])
 read(3, "\0\0\0\n\v\0\0\0\2\0\0\0\1/", 16384) = 14
 open("/", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 5
 select(5, [3], [4], NULL, NULL)         = 1 (out [4])
 write(4, "\0\0\0\rf\0\0\0\2\0\0\0\4\0\0\0\0", 17) = 17
 select(5, [3], [], NULL, NULL)          = 1 (in [3])
 read(3, "\0\0\0\r\f\0\0\0\3\0\0\0\4\0\0\0\0", 16384) = 17
 getdents(5, /* 3 entries */, 32768)     = 80
 lstat("/.", {st_mode=S_IFDIR|0750, st_size=4096, ...}) = 0
 stat("/etc/localtime", 0x7fff44193d90)  = -1 ENOENT (No such file or directory)
 open("/etc/localtime", O_RDONLY)        = -1 ENOENT (No such file or directory)
 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 open("/etc/group", O_RDONLY|O_CLOEXEC)  = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 lstat("/..", {st_mode=S_IFDIR|0750, st_size=4096, ...}) = 0
 open("/etc/localtime", O_RDONLY)        = -1 ENOENT (No such file or directory)
 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 open("/etc/group", O_RDONLY|O_CLOEXEC)  = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 lstat("/attreport", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
 open("/etc/localtime", O_RDONLY)        = -1 ENOENT (No such file or directory)
 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 open("/etc/group", O_RDONLY|O_CLOEXEC)  = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 getdents(5, /* 0 entries */, 32768)     = 0
 select(5, [3], [4], NULL, NULL)         = -1 EBADF (Bad file descriptor)
 sendto(7, "<83>Feb 27 22:02:23 sshd[7071]: "..., 66, MSG_NOSIGNAL, NULL, 0) = -1 EBADF (Bad file descriptor)
 close(7)                                = -1 EBADF (Bad file descriptor)
 socket(PF_FILE, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
 connect(4, {sa_family=AF_FILE, path="/dev/log"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 exit_group(2)                           = ?
 Process 7071 detached

`

share|improve this question
    
When you say everything works great, that includes downloading a file, right? Any idea what /var/lib/pbis/.lsassd is? –  Gilles Feb 27 '12 at 22:50
    
Yup - I can upload, download, pwd - everything but ls. It appears that /var/lib/pbis/.lsassd is a likewise file, so AD authentication. –  Greg Cain Feb 27 '12 at 23:21
add comment

3 Answers

Had the same problem, but running on RHEL 5.5.
Openssh-server 5.x using internal chroot with the match statement and pbis AD integration. Found two work-arounds:

  1. Change the passwd and group lines in /etc/nsswitch.conf from:

    passwd:     files lsass
    

    to look like:

    passwd:     files [UNAVAILABLE=return] lsass
    
  2. Create /etc/passwd and /etc/group files in the root of the chrooted environment. The files only need to hold the minimum amount of records based on the owners of the underlying files and directories.

share|improve this answer
add comment

If you run sftp only you can configure your sshd to use the internal sftp. That sftp will have all commands built in in a minimal version - the chroot just needs /dev/null, zero, random, urandom to work. ls will be a built-in command there as well.

No messing around with keeping your binaries and libraries in chroot up to date any more...

share|improve this answer
    
That's what I was doing. ls wasn't working in that scenario because of the likewise issue above. –  Greg Cain Mar 7 '12 at 21:50
    
Interesting. So ls tries to resolve UID and GID to names in that environment, too. –  Nils Mar 8 '12 at 16:22
    
Apparently so. I copied the /etc/passwd and /etc/group to the chrooted environment, but it didn't help. –  Greg Cain Mar 8 '12 at 17:14
add comment
up vote 3 down vote accepted

This ended up being an issue with Likewise Open. "ls" was the only command that try to resolve UID/GID when sftp'ing, and in doing so, it went to likewise for resolution, and as soon as it did, it crashed.

/etc/nsswitch.conf was setup to use files first:

passwd:     files lsass
shadow:     files
group:      files lsass

but for some reason it still went to likewise. The solution was to add the correct group to "RequireMembershipOf", which for RHEL6 was in /opt/likewise/bin/lwconfig.txt

share|improve this answer
    
From what I can find, it looks like answering your own question is acceptable. If it's not, please let me know. –  Greg Cain Mar 7 '12 at 17:49
1  
From what I can see in your strace it failed to open /etc/group. Do you run in a chroot-environment? –  Nils Mar 7 '12 at 19:59
    
Yes, it is chrooted. I'll clarify the question. –  Greg Cain Mar 7 '12 at 20:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.