Tag Info

Hot answers tagged

21

When you fail to execute a file that depends on a “loader”, the error you get may refer to the loader rather than the file you're executing. The loader of a dynamically-linked native executable is the part of the system that's responsible for loading dynamic libraries. It's something like /lib/ld.so or /lib/ld-linux.so.2, and should be an executable file. ...


15

SSH Supports chrooting an SFTP user natively. You just need to supply ChrootDirectory In your sshd config file, and restart sshd. If you are just doing sftp, then you don't have to do anything more. Unfortunately, this doesn't work for scp. For interactive shell, you will need to copy binaries, and /dev nodes into the chroot. An example config, for ...


14

What I've done here is to test whether the root of the init process (PID 1) is the same as the root of the current process. Although /proc/1/root is always a link to / (unless init itself is chrooted, but that's not a case I care about), following it leads to the “master” root directory. This technique is used in a few maintenance scripts in Debian, for ...


14

A chroot jail is a way to isolate a process from the rest of the system. It should only be used for processes that don't run as root, as root users can break out of the jail very easily. The idea is that you create a directory tree where you copy or link in all the system files needed for a process to run. You then use the chroot system call to change the ...


13

Symlinks are essentially just pointers to another file, you can't point to something outside the chroot because it is looking for a file with that name (/var/www, which doesn't exist inside the chroot). Hardlinks on the other hand are pointers to the inode. As such, if you want to do that, you need to use a hard link by omitting -s. However, you cannot hard ...


11

You could use mount to remount the directories you need in your jail: # mount --bind /bin /chroot/bin # mount --bind /lib /chroot/lib # chroot /chroot For use in /etc/fstab: /bin /chroot/bin none bind /lib /chroot/lib none bind Cheers!


10

Chroot is the lightest weight environment that could suit you. It allows you to install another distribution (or another installation of the same distribution), with the same users, with the same network configuration, etc. Chroot only provides some crude isolation at the filesystem level. Browsing this site for chroot might help, if you're still not sure ...


10

You should read about .bash_profile and .bashrc. The bracketed information is just a preference in those files which typically live in your home directory and/or /etc/profile (look for the line that starts PS1=). I'm assuming that when you're chrooted, that user does not have access to its home folder to load these files, so your prompt is, essentially, ...


9

/proc and (usually) much of /dev are read only kernel-generated "filesystems". You don't delete them, you just umount the filesystem. If rm -r /proc/6352 worked, it would have to be semantically equivalent to kill -9 6352, since it's really just presenting information about pid 6352, not actual files anywhere. Use mount to see what mounted filesystems are ...


8

"chroot jail" is a misnomer that should really die out, but people keep using it. chroot is a tool that lets you simulate a directory on your filesystem as the root of the filesystem. That means you can have a folder structure like: -- foo -- bar -- baz -- bazz If you chroot foo and do ls /, you'll see: -- bar -- baz As far as ls (and any other ...


8

A chroot is a reasonably simple method. Since the operating system already has this security feature, daemon writers tend not to attempt to reimplement it. Rssh comes with a guide on setting up a chroot jail. It's in the CHROOT file in the source distribution. In a nutshell, you need to have: A few binaries, copied from the root: /usr/bin/scp, ...


7

You might want to look at scponly; it's essentially a login shell that can only be used to launch scp or the sftpd subsystem. In the scponlyc variant it performs a chroot before activating the subsystem in question.


7

If you're trying to get any chrooted app to show up in X11, you will need a couple of things set up correctly. One is a valid DISPLAY environment variable, second is a proper Xauthority file, and third and most important, access to the socket used by X11/Xorg. X11 can use either a TCP network socket or a Unix Domain socket. A TCP socket will be easier to ...


7

AppArmour is usually thought to be simpler then SELinux. SELinux is quite complex and may be used even in military applications while AppArmour tends to be simpler. SELinux operates on i-node level (i.e. restrictions are applied in the same way as ACL or unix permissions - on the other hand ) while AppArmour apply at path level (i.e. you specify the access ...


7

To achieve this need following things : Method 1# By changing User's Home directory Make sure following line exists chroot_local_user=YES Set User HOME Directory to /var/www/ , if you want to change for existing user then you can use : usermod --home /var/www/ username then set required permission on /var/www/ Method 2# If you don't want to ...


6

Mock is what you're looking for. It's based on Mach and is packaged in EPEL. I regularly use it to build RPM packages for and on RHEL and Fedora.


6

Chroot only restricts filesystem access. If you have root permissions, a chroot is merely an inconvenience, not a secure confinement. Ordinary users can use sockets but not shut down the machine. There are ways to restrict what users can do: capabilities, AppArmor, SELinux, … But by far the easiest way is to confine the webapp user to a virtual machine. You ...


6

No. There is no official Arch Linux repository for ARM. However, there is a fork of Arch for ARM: http://archlinuxarm.org/


6

It's /dev/initctl, which is (often? always?) used to interact with init (pid 0), e.g. Upstart. From your updated chroot entrance sequence, you bound /dev/, so there is a /dev/initctl in your chroot. Triggering a reboot can this way reboot your system. This probably won't be this way much longer, as many distributions (e.g. Debian) introduce /run/, where ...


6

Short answer -- there is as far as I know no out of the box working solution for your specific requirements. You will have to adjust each initramfs of each distribution to support your specific needs. Long answer -- yes it is possible. Nowadays most Linux distributions use an initramfs which will be loaded into memory by the bootloader and then unpacked by ...


6

You cannot chroot into different architecture. By chrooting, you are executing the binaries (from the chroot) on your architecture. Executing ARM binaries on x86 (and x86_64 in that matter) would lead to "Exec format error". If you want to run binaries from different architecture you will need an Emulation, Qemu is a good candidate for this, but you will ...


6

Change the user's default shell in /etc/passwd to the command (or a wrapper script for that command) that logs that user into the chroot.


6

You have to first exit the chroot session, usually a simple exit will do. You may want to do a sync first. sync exit Then umount ALL the binded directory umount /mnt/rescue/dev/ umount /mnt/rescue/proc/ umount /mnt/rescue/sys/ Then umount /mnt/rescue


6

It's quite simple. You have to add the following option on the vsftpd.conf file chroot_local_user=YES The documentation inside the configuration file is self-explanatory: # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of # users to NOT chroot(). This ...


6

Well, you probably don't need to unmount /proc. The procfs is not even a real filesystem, rather a representation of the contents of memory and the currently running processes. What you want is probably to bind mount it to a location inside the chroot: # mkdir -m 0555 /tmp/newroot/proc # mount --bind /proc /tmp/newroot/proc


6

Although POSIX has a standard for capabilities which I think includes CAP_NET_BIND_SERVICE, these are not required for conformance and may in some ways be incompatible with the implementation on, e.g., linux. Since webservers like apache are not written for only one platform, using root privileges is the most portable method. I suppose it could do this ...


5

Single ssh server If the only reason you're planning to run an SSH server in a chroot is to restrict password authentication to some users, you don't need that: you can tell sshd to allow passwords only for a whitelist of users. In /etc/ssh/sshd_config, use a Match directive: PasswordAuthentication No Match User trusted_user_1,trusted_user_2 ...


5

Did you restart the sshd service after making the changes to /etc/ssh/sshd_config? sudo /etc/init.d/ssh restart Ensure the chroot directory for the sftp user (in this case /home/lenny) is owned by root, not the sftp user. chmod 755 is correct. Also, I would add the following two lines for additional security: Match User lenny ChrootDirectory ...


5

You need to provide either the X magic cookies credentials (see DISPLAY and AUTHORITY) or allow connections from localhost via xhost +local:. You still need to provide the correct DISPLAY variable, typically DISPLAY=:0. Based on your error message you probably didn't specified the DISPLAY variable, check your DISPLAY variable outside of the chroot with echo ...


5

I would suggest allowing to connect only via public key. Then you can connect that public key with your own command by supplying it in ~/.ssh/authorized_keys like that: command="/path/to/mycommand" ssh-rsa ... Whenever the user logs into that account with that key your command is executed instead of the usual shell. That command can for example be a shell ...



Only top voted, non community-wiki answers of a minimum length are eligible