3

I am using CentOS 7.

I need to give shell access to ssh users but restrict them in a jail. I have used jailkit to set up the jail. I have copied all necessary libraries, binaries that are needed for the user in the jailed environment. The jail directory structure looks like this:

[root@server jail]# pwd

/var/jail

[root@server jail]# ls -l

total 8

drwxr-xr-x. 2 root root   26 May 28 16:17 bin

drwxr-xr-x. 2 root root   41 May 28 16:18 dev

drwxr-xr-x. 3 root root 4096 May 28 16:22 etc

drwxr-xr-x. 3 root root   19 May 28 16:14 home

drwxr-xr-x. 2 root root 4096 May 28 16:09 lib

lrwxrwxrwx. 1 root root    9 May 28 16:14 lib64 -> usr/lib64

drwxr-xr-x. 7 root root   65 May 28 16:18 usr

I have used 'jk_jailuser' to move user home directory to /var/jail/home.

However, when the user logs in, he can cd into other directories in the jailed environment. I want the user to be restricted to his/her home directory and not be able to cd to any other directory.

I have tried to use the Match group directive in sshd_config as follows:

      Match group sshusers

          ChrootDirectory /var/jail/

          X11Forwarding no

          AllowTcpForwarding no

but this is the error I get when I try to login through ssh after setting it:

Could not chdir to home directory /var/jail/./home/user: No such file or directory

/usr/sbin/jk_chrootsh: No such file or directory

and I can't login

I am really stuck here. I can't figure out how to resolve this problem. can someone please help? How can I restrict SSH users to their home directories in a jailed environment?

1 Answer 1

0

The home directory of the user should be relative to the chroot path. If you want to use /var/jail/home/user as the home directory, you will have to set the user's home to /home/user.

1
  • The user's home directory is set to: /var/jail/./home/user in /etc/passwd And it is set to /home/user in /var/jail/etc/passwd
    – Soban
    May 31, 2015 at 8:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .