3

Distribution: Scientific Linux 6.5 (Carbon), not exactly your typical brand of linux.

Tried to chroot a user using these instructions for SSH and quite obviously failed, and now I can't even log in with that user. I checked /var/log/secure to see if that could shed any light on it, and I got the following.

: Address aaa.bbb.ccc.ddd maps to "A_Certain_Computer"
: Accepted password for student.fesns from aaa.bbb.ccc.ddd port ##### ssh2
: pam_unix(sshd:session): session opened for user student.fesns by (uid=0)
: error: /dev/pts/2: No such file or directory
: error: open /dev/tty failed - could not set controlling tty: No such file or directory
: pam_unix(sshd:session): session closed for user student.fesns

I checked both the files, and they do actually exist. I then attempted to reverted the changes I made to try and chroot the user, so the home directory is back to /home/User, and the startup script is set ot /bin/bash, and I've removed the section of code in /etc/ssh/sshd_config to revert it back to its original settings.

I'm completely lost at this point. Any insight would be appreciated.

New Informatoin I've also added another user and been able to login successfully. I then changed its group to the group of the first user, and then it did the same thing as the first one.

After that I deleted and reecreated the group, still couldn't login. Then I changed the user and test account to a different group and it worked fine.

....so I guess this is solved, but what the heck went on there?

Update

Alright, so I was back at it today. Used pretty much the same instructions after giving everything a nice clean slate. Created the environment using the make_chroot_jail.sh script. Altered the /etc/ssh/sshd_config so that it it would chroot to the chroot folder.

Folder Scheme: /home/chroot/{bin,dev,etc,home,lib,lib64,sbin,usr}

I've also confirmed that the dev folder contains the tty character device, and in addition, I learned that the pts items couldn't be called normally becuase they weren't really files or something. In any case, followed that lead, and restarted the service and instead of the original error I then got the following.

: error: /dev/pts/1: Permission denied
: error: open /dev/tty failed - could not set controlling tty: Permission denied

Time's up today though, I'm going to try freeing up the permissions on the two files but that sorta defeats part of the purpose of doing the chroot.

  • Did you check for those two files under chroot or real root? Have you restarted sshd after editing sshd_config? – artm Oct 10 '14 at 21:37
  • Originally I had only checked the real root, but after working with it today I did confirm that it is also in the chroot as well. – Mason Oct 16 '14 at 21:05
1

Given your description of the solution, you must have made some error with the group permissions when you set the chroot up. Since you've deleted and re-created everything, it's hard to figure out exactly what it was. At a guess, you've managed to create settings where the files within the chroot were readable for everyone except for the one group that the users were in when you started.

  • Made some progress today, not exactly much but its something. Please check it out. – Mason Oct 16 '14 at 21:17
0

Try 'mount --bind' the following directories. Make sure you do /dev first then /dev/pts.

root-shell> mount --bind /dev /var/jail/dev

root-shell> mount --bind /dev/pts /var/jail/dev/pts

Regards, David

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.