1

I'm trying to create a jail for a user in my server. Let's call the user "juser".

What do I want to achieve? I want an ssh user to be jailed in his home folder and not have any access (whatsoever) on my server's root directory.

For that, I'm following the tutorial given in here.

Everything went fine, until the step of Privileges Separation. Now I don't want to disable privilage separation as it is a security threat to the system.

The other solution is in the next line in the tutorial:

If you don't disable Privilege Separation you will need an /etc/passwd which includes the user's UID inside the chroot for Privilege Separation to work properly.

But I don't know how to do this! In /etc/passwd I have for juser:

juser:x:5002:5002::/home/juser:/bin/sh

How do I implement what is said in the quoted sentence?

1

Let us say the chroot is in /path/to/chroot. Then you need:

  1. A directory etc in /path/to/chroot, and
  2. A file called passwd in /path/to/chroot/etc, with at least one entry:

    juser:x:5002:5002::/some/path:/some/shell
    
  3. And both:
    • /path/to/chroot/some/path
    • /path/to/chroot/some/shell (The shell must be present, along with any necessary libraries and such.)
  • I'm not sure what to do about the shell... should I install a static shell inside that user's chroot? – The Quantum Physicist Dec 10 '14 at 16:45
  • @TheQuantumPhysicist If you can get a static binary for the shell, sure. If not, use ldd to find the relevant libraries and copy them over as well: unix.stackexchange.com/q/85258/70524 – muru Dec 10 '14 at 16:48
  • Should this line be the same one in the root's /etc/passwd? After I set the parameters as you mention, I'm unable to login with the new user at all! ssh fails to login simply with no reason. – The Quantum Physicist Dec 10 '14 at 23:01
  • @TheQuantumPhysicist which step does it fail at? Connection? Authentication? Starting the shell? – muru Dec 10 '14 at 23:08
  • Authentication. Could you please tell me what to do with the server root's passwd? – The Quantum Physicist Dec 10 '14 at 23:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.