Hot answers tagged

61

No matter the fancy name used here, both are solutions to a specific problem: A better segregation solution than classic Unix chroot. Operating system-level virtualization, containers, zones, or even "chroot with steroids" are names or commercial titles that define the same concept of userspace separation, but with different features. Chroot was introduced ...


19

More similar Qs with more answers worth attention: http://stackoverflow.com/q/3859710/94687 http://stackoverflow.com/q/4410447/94687 http://stackoverflow.com/q/4249063/94687 http://stackoverflow.com/q/1019707/94687 some of the answers there point to specific solutions not yet mentioned here. (Actually, there are quite a few jailing tools with ...


11

Starting the process inside a network namespace that can only see the desired IP address can accomplish something similar. For instance, supposed I only wanted localhost available to a particular program. First, I create the network namespace: ip netns add limitednet Namespaces have a loopback interface by default, so next I just need to bring it up: ...


9

command should not contain multiple words. This is the cause of the [ error you see. You should set any flags separately. Also, you should use pytivo_user to set the running uid, and not daemon -u. See the rc.subr(8) man page for all these magic variables. Also, you should let the rc subsystem know that pytivo is a Python script so that it can find the ...


8

This is a fundamental limitation of the unix permission model: only root can delegate. You don't need to be root to run a virtual machine (not true of all VM technologies), but this is a heavyweight solution. User-mode Linux is a relatively lightweight Linux-on-Linux virtualization solution. It's not that easy to set up; you'll need to populate a root ...


6

Following the updated information, you should have them do private/public key pairs and inside the .ssh/authorized_keys file set it to only run script.php file. You shouldn't rely on the .bashrc for protection, especially since that is needed to initialize the environment.


6

login calls the login command/shell of the user with its argv[0] starting with a -. Shells check their argv[0] to determine if they're being called as a login shell. As @slm says, it's clearly specified in the "Invocation" section of the bash manual. In addition, a few shells like csh, tcsh, ksh, zsh, yash, bash and some variants of the Almquist shell ...


5

Normally bash knows that it's a login shell because when the login program invokes it, it tells bash that its name is -bash. That name is in argv[0], the zeroth command line argument, which is conventionally the way the user invoked the program. The initial hyphen is a convention to tell a shell that it's a login shell. Bash also behaves as a login shell if ...


5

The solution must probably be based either on ptrace or namespaces (unshare). ptrace-based solutions are probably less efficient then namespaces/unshare-based (but the latter technology is cutting-edge and is not well explored path, probably). ptrace-based UMView As for ptrced-based solutions, thanks to the comments at ...


5

I would suggest allowing to connect only via public key. Then you can connect that public key with your own command by supplying it in ~/.ssh/authorized_keys like that: command="/path/to/mycommand" ssh-rsa ... Whenever the user logs into that account with that key your command is executed instead of the usual shell. That command can for example be a shell ...


5

You need to install/update your ports catalogue first. Run these commands first: portsnap fetch update portsnap extract you can then run your: pkg install mysql55-server (note: it is mysql55-server and not mysql-server)


5

The jail and the host system will both share the same kernel. So: Old jail, recent host: Running an outdated jail on a newer host should not cause any issue (the FreeBSD kernel will ensure retro-compatibility, enabled by default even for pre-FreeBSD 8 kernel as a kernel compilation option), Recent jail, old host: I would not try to run a newer jail on an ...


4

You can change shell for the user in question to whatever you like in the last field on the appropriate line in /etc/passwd, e.g.: specialuser:x:12345:123::/home/specialuser:/usr/bin/restricted_script.php if you include appropriate hash-bang (e.g. #!/usr/bin/php on the first line of the script) it should work right away. For security reasons I would ...


4

Firejail is a Linux namespaces sandbox program that can jail Firefox or any other GUI software. It should work on any Linux computer.


4

if you really want to lock down this user as much as possible create a virtual machine. The chroot don't really isolate this process. If a real virtual machine is too heavy, maybe you can have a look at linux containers, a lightweight version of virtual machine. Harder to configure though. If you want something even more lightweight you can try to ...


4

It is effectively creating a directory /local/jails so simplistically the following could be considered equivalent: mkdir -p /local/jails However, this will create the directory path in the root file system, so you need to ensure that this file system is big enough. Some UFS installations use different partitions (or slices) for / and /usr, so / may be ...


3

You have 2 options: chroot_local_user=YES chroot_list_enable=YES chroot_list_file=/etc/vsftpd/nonchroot.list Where file /etc/vsftpd/nonchroot.list should contail the users you don’t want to chroot. OR chroot_list_enable=YES chroot_list_file=/etc/vsftpd/chroot.list Where the file /etc/vsftpd/chroot.list should contain the users you want to be chrooted ...


3

I just found out that I had mounted onto a directory which itself is already rebound (mounted via nullfs). /var/data/home/j/mroot on /var/data/home/j/www /var/data/home/js/www on /var/data/home/j/www/s /foo on /var/data/home/js/www/foo Besides being confusing this is apparently unsupported / wrong. I changed it like so (note the path in the last line): ...


3

make distribution just installs new configuration files, while mergemaster walks interactively over all config files and asks you which ones you want (and intelligently upgrades files you never edited in the first place if possible). It even gives you the option to merge them as needed. Basically, it automates the process of installing updated config files, ...


3

I doubt you could allow them to fully use all your programs but unable to read files outside of their home. All it would take is one program that depends on a configuration file to destroy that. You could create a virtual machine and give them user (or root) access to the virtual machine. Some common VM solutions are: Xen VirtualBox KVM OpenVZ


3

You need to run pulseaudio in system mode, and let all users access it, unfortunately, this is strongly discouraged by the upstream Pulseaudio developers. Here's a systemd service script that should improve on the above: # /etc/systemd/system/pulseaudio.service: [Unit] Description=PulseAudio Daemon [Install] WantedBy=multi-user.target [Service] Type=simple ...


3

I wasn't aware of Pulseaudio running on Fedora as audio server. After researching, I have finally found a way to share audio (microphone and speakers) among other users, while running Pulseaudio as normal user (myself) and not in System Mode. In order to do that you will only need to copy initial configuration file to your home directory: cp ...


3

Change the name of the executable (note that that also affects PAM configuration). ln /path/to/sshd /path/to/sshd-whatever Start as /path/to/sshd-whatever. And define PAM configuration in /etc/pam.d/sshd-whatever. Log entries will show as sshd-whatever instead of sshd.


3

OK, I got it now. After a few check on the FreeBSD forum, I can now confirm that FreeBSD jails act a bit like some Swiss cheese as long as SHM objects are concerned. Indeed, FreeBSD does not provide any isolation at all for SHM objects: all jails can access all SHM objects, system-wide, with no way to prevent it. The error mentioned in this question is ...


2

One of the most easy/efficient way to control what a user can do is lshell. lshell is a shell coded in Python, that lets you restrict a user's environment to limited sets of commands, choose to enable/disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restriction, and more.


2

Firejail is a Linux namespaces sandbox program that can jail Skype, Firefox or any other GUI software. It should work on any Linux computer.


2

You have a few options that will make your home directory (or part of it) off limits. Change your home directory to owner only access using chmod 700 ~. This will allow only you and root to access the directory. Move your home directory to an encrypted file system. (This will prevent them from accessing it when you don't have it unencrypted. Combine ...


2

Jails get ip aliases on your network interface. If the jails use the same interface as the host and are on the same subnet you don't need to do any additional routing. If your jails do not use the same interface you would need to bridge the primary interface with the interface the Jails use.


2

Take a look at the bash man page. They discuss the differences in how it can be invoked there. The section is called INVOCATION. The 2 primary ways it get's invoked are as a login shell (bash -l) and as a interactive shell (bash -i). Take a look at this other Unix and Linux Q&A titled: Difference between Login Shell and Non-Login Shell?. It pretty much ...


2

You can use Subversion in basically the same way as documented for cvsup. In short: # portsnap update # cd /usr/ports/devel/subversion # make install clean Then to update /usr/src (assuming you have sources installed): # svn update /usr/src If sources are not already installed in /usr/src, you can check out a fresh working copy: # svn checkout ...



Only top voted, non community-wiki answers of a minimum length are eligible