3

I am using CentOS 7.

I need to give shell access to ssh users but restrict them in a jail. I have used jailkit to set up the jail. I have copied all necessary libraries, binaries that are needed for the user in the jailed environment. The jail directory structure looks like this:

[root@server jail]# pwd

/var/jail

[root@server jail]# ls -l

total 8

drwxr-xr-x. 2 root root   26 May 28 16:17 bin

drwxr-xr-x. 2 root root   41 May 28 16:18 dev

drwxr-xr-x. 3 root root 4096 May 28 16:22 etc

drwxr-xr-x. 3 root root   19 May 28 16:14 home

drwxr-xr-x. 2 root root 4096 May 28 16:09 lib

lrwxrwxrwx. 1 root root    9 May 28 16:14 lib64 -> usr/lib64

drwxr-xr-x. 7 root root   65 May 28 16:18 usr

I have used 'jk_jailuser' to move user home directory to /var/jail/home.

However, when the user logs in, he can cd into other directories in the jailed environment. I want the user to be restricted to his/her home directory and not be able to cd to any other directory.

I have tried to use the Match group directive in sshd_config as follows:

      Match group sshusers

          ChrootDirectory /var/jail/

          X11Forwarding no

          AllowTcpForwarding no

but this is the error I get when I try to login through ssh after setting it:

Could not chdir to home directory /var/jail/./home/user: No such file or directory

/usr/sbin/jk_chrootsh: No such file or directory

and I can't login

I am really stuck here. I can't figure out how to resolve this problem. can someone please help? How can I restrict SSH users to their home directories in a jailed environment?

0

The home directory of the user should be relative to the chroot path. If you want to use /var/jail/home/user as the home directory, you will have to set the user's home to /home/user.

  • The user's home directory is set to: /var/jail/./home/user in /etc/passwd And it is set to /home/user in /var/jail/etc/passwd – Soban May 31 '15 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.