Tag Info

Hot answers tagged

16

When you fail to execute a file that depends on a “loader”, the error you get may refer to the loader rather than the file you're executing. The loader of a dynamically-linked native executable is the part of the system that's responsible for loading dynamic libraries. It's something like /lib/ld.so or /lib/ld-linux.so.2, and should be an executable file. ...


15

SSH Supports chrooting an SFTP user natively. You just need to supply ChrootDirectory In your sshd config file, and restart sshd. If you are just doing sftp, then you don't have to do anything more. Unfortunately, this doesn't work for scp. For interactive shell, you will need to copy binaries, and /dev nodes into the chroot. An example config, for ...


14

What I've done here is to test whether the root of the init process (PID 1) is the same as the root of the current process. Although /proc/1/root is always a link to / (unless init itself is chrooted, but that's not a case I care about), following it leads to the “master” root directory. This technique is used in a few maintenance scripts in Debian, for ...


12

A chroot jail is a way to isolate a process from the rest of the system. It should only be used for processes that don't run as root, as root users can break out of the jail very easily. The idea is that you create a directory tree where you copy or link in all the system files needed for a process to run. You then use the chroot system call to change the ...


12

Symlinks are essentially just pointers to another file, you can't point to something outside the chroot because it is looking for a file with that name (/var/www, which doesn't exist inside the chroot). Hardlinks on the other hand are pointers to the inode. As such, if you want to do that, you need to use a hard link by omitting -s. However, you cannot hard ...


11

You could use mount to remount the directories you need in your jail: # mount --bind /bin /chroot/bin # mount --bind /lib /chroot/lib # chroot /chroot For use in /etc/fstab: /bin /chroot/bin none bind /lib /chroot/lib none bind Cheers!


10

You should read about .bash_profile and .bashrc. The bracketed information is just a preference in those files which typically live in your home directory and/or /etc/profile (look for the line that starts PS1=). I'm assuming that when you're chrooted, that user does not have access to its home folder to load these files, so your prompt is, essentially, ...


9

/proc and (usually) much of /dev are read only kernel-generated "filesystems". You don't delete them, you just umount the filesystem. If rm -r /proc/6352 worked, it would have to be semantically equivalent to kill -9 6352, since it's really just presenting information about pid 6352, not actual files anywhere. Use mount to see what mounted filesystems are ...


8

A chroot is a reasonably simple method. Since the operating system already has this security feature, daemon writers tend not to attempt to reimplement it. Rssh comes with a guide on setting up a chroot jail. It's in the CHROOT file in the source distribution. In a nutshell, you need to have: A few binaries, copied from the root: /usr/bin/scp, ...


8

"chroot jail" is a misnomer that should really die out, but people keep using it. chroot is a tool that lets you simulate a directory on your filesystem as the root of the filesystem. That means you can have a folder structure like: -- foo -- bar -- baz -- bazz If you chroot foo and do ls /, you'll see: -- bar -- baz As far as ls (and any other ...


8

Chroot is the lightest weight environment that could suit you. It allows you to install another distribution (or another installation of the same distribution), with the same users, with the same network configuration, etc. Chroot only provides some crude isolation at the filesystem level. Browsing this site for chroot might help, if you're still not sure ...


7

You might want to look at scponly; it's essentially a login shell that can only be used to launch scp or the sftpd subsystem. In the scponlyc variant it performs a chroot before activating the subsystem in question.


7

AppArmour is usually thought to be simpler then SELinux. SELinux is quite complex and may be used even in military applications while AppArmour tends to be simpler. SELinux operates on i-node level (i.e. restrictions are applied in the same way as ACL or unix permissions - on the other hand ) while AppArmour apply at path level (i.e. you specify the access ...


7

You cannot chroot into different architecture. By chrooting, you are executing the binaries (from the chroot) on your architecture. Executing ARM binaries on x86 (and x86_64 in that matter) would lead to "Exec format error". If you want to run binaries from different architecture you will need an Emulation, Qemu is a good candidate for this, but you will ...


6

Chroot only restricts filesystem access. If you have root permissions, a chroot is merely an inconvenience, not a secure confinement. Ordinary users can use sockets but not shut down the machine. There are ways to restrict what users can do: capabilities, AppArmor, SELinux, … But by far the easiest way is to confine the webapp user to a virtual machine. You ...


6

It's /dev/initctl, which is (often? always?) used to interact with init (pid 0), e.g. Upstart. From your updated chroot entrance sequence, you bound /dev/, so there is a /dev/initctl in your chroot. Triggering a reboot can this way reboot your system. This probably won't be this way much longer, as many distributions (e.g. Debian) introduce /run/, where ...


6

Short answer -- there is as far as I know no out of the box working solution for your specific requirements. You will have to adjust each initramfs of each distribution to support your specific needs. Long answer -- yes it is possible. Nowadays most Linux distributions use an initramfs which will be loaded into memory by the bootloader and then unpacked by ...


6

Well, you probably don't need to unmount /proc. The procfs is not even a real filesystem, rather a representation of the contents of memory and the currently running processes. What you want is probably to bind mount it to a location inside the chroot: # mkdir -m 0555 /tmp/newroot/proc # mount --bind /proc /tmp/newroot/proc


6

Although POSIX has a standard for capabilities which I think includes CAP_NET_BIND_SERVICE, these are not required for conformance and may in some ways be incompatible with the implementation on, e.g., linux. Since webservers like apache are not written for only one platform, using root privileges is the most portable method. I suppose it could do this ...


5

If you're trying to get any chrooted app to show up in X11, you will need a couple of things set up correctly. One is a valid DISPLAY environment variable, second is a proper Xauthority file, and third and most important, access to the socket used by X11/Xorg. X11 can use either a TCP network socket or a Unix Domain socket. A TCP socket will be easier to ...


5

Single ssh server If the only reason you're planning to run an SSH server in a chroot is to restrict password authentication to some users, you don't need that: you can tell sshd to allow passwords only for a whitelist of users. In /etc/ssh/sshd_config, use a Match directive: PasswordAuthentication No Match User trusted_user_1,trusted_user_2 ...


5

Did you restart the sshd service after making the changes to /etc/ssh/sshd_config? sudo /etc/init.d/ssh restart Ensure the chroot directory for the sftp user (in this case /home/lenny) is owned by root, not the sftp user. chmod 755 is correct. Also, I would add the following two lines for additional security: Match User lenny ChrootDirectory ...


5

You need to provide either the X magic cookies credentials (see DISPLAY and AUTHORITY) or allow connections from localhost via xhost +local:. You still need to provide the correct DISPLAY variable, typically DISPLAY=:0. Based on your error message you probably didn't specified the DISPLAY variable, check your DISPLAY variable outside of the chroot with echo ...


5

I would suggest allowing to connect only via public key. Then you can connect that public key with your own command by supplying it in ~/.ssh/authorized_keys like that: command="/path/to/mycommand" ssh-rsa ... Whenever the user logs into that account with that key your command is executed instead of the usual shell. That command can for example be a shell ...


5

You have to first exit the chroot session, usually a simple exit will do. You may want to do a sync first. sync exit Then umount ALL the binded directory umount /mnt/rescue/dev/ umount /mnt/rescue/proc/ umount /mnt/rescue/sys/ Then umount /mnt/rescue


5

This cannot be done by the bootloader or kernel. The parameter to the kernel root option such as in root=/dev/sda1 looks like a standard Unix pathname, but such pathnames are interpreted according to currently mounted filesystem. At the time the root option is interpreted, there are no mounted filesystems. Well, almost none. At kernel initialization time ...


4

As mentioned in Portable way to find inode number and Detecting a chroot jail from within, you can check whether the inode number of / is 2: $ ls -di / 2 / An inode number that's different from 2 indicates that the apparent root is not the actual root of a filesystem. This will not detect chroots that happen to be rooted on a mount point.


4

A chroot should not impact performance. I haven't heard of any benchmark on it because it's really just a mapping between two spaces. Anyway, for your problem, maybe it should be better to use something like LXC. Instead of moving somethings working, you can simply create a LXC and do your stuff inside this LXC. LXC is far better than chroot and has really ...


4

Methods such as creating the file /etc/nologin, setting account login shells to /bin/false or /sbin/nologin effectively disable user accounts from logging into an interactive shell, but do not protect the system. If you want to specifically restrict a user to using scp or sftp only, install a restricted shell that is designed to do exactly that. The rssh ...


4

OpenVZ is a kernel-level virtualization feature. It's different from a chroot. As far as I know, there's no direct interaction between OpenVZ and chroot, you can use chroot in an OpenVZ VM. chroot only acts on the process it starts. There's zero risk in trying it out on the command line. Just remember not to change your boot scripts or login scripts if you ...



Only top voted, non community-wiki answers of a minimum length are eligible