1

I'm trying to create a jail for a user in my server. Let's call the user "juser".

What do I want to achieve? I want an ssh user to be jailed in his home folder and not have any access (whatsoever) on my server's root directory.

For that, I'm following the tutorial given in here.

Everything went fine, until the step of Privileges Separation. Now I don't want to disable privilage separation as it is a security threat to the system.

The other solution is in the next line in the tutorial:

If you don't disable Privilege Separation you will need an /etc/passwd which includes the user's UID inside the chroot for Privilege Separation to work properly.

But I don't know how to do this! In /etc/passwd I have for juser:

juser:x:5002:5002::/home/juser:/bin/sh

How do I implement what is said in the quoted sentence?

1 Answer 1

1

Let us say the chroot is in /path/to/chroot. Then you need:

  1. A directory etc in /path/to/chroot, and
  2. A file called passwd in /path/to/chroot/etc, with at least one entry:

    juser:x:5002:5002::/some/path:/some/shell
    
  3. And both:
    • /path/to/chroot/some/path
    • /path/to/chroot/some/shell (The shell must be present, along with any necessary libraries and such.)
10
  • I'm not sure what to do about the shell... should I install a static shell inside that user's chroot? Dec 10, 2014 at 16:45
  • @TheQuantumPhysicist If you can get a static binary for the shell, sure. If not, use ldd to find the relevant libraries and copy them over as well: unix.stackexchange.com/q/85258/70524
    – muru
    Dec 10, 2014 at 16:48
  • Should this line be the same one in the root's /etc/passwd? After I set the parameters as you mention, I'm unable to login with the new user at all! ssh fails to login simply with no reason. Dec 10, 2014 at 23:01
  • @TheQuantumPhysicist which step does it fail at? Connection? Authentication? Starting the shell?
    – muru
    Dec 10, 2014 at 23:08
  • Authentication. Could you please tell me what to do with the server root's passwd? Dec 10, 2014 at 23:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.