at the moment I am creating a chroot jail. Therefore I read some articles and everything seems to be clear, exept for one thing: the chroot jail shell

In one source they created the following setup (of course the setup is much bigger, but this is the part I have a question in):

The jail is set up with some programs and there libs.
The chroot jail folder is /jail/.
Now we want to create the user prison within our new jail.
Therefore we open the file /etc/sudoers and write the following line in it:

prison ALL=NOPASSWD: /usr/bin/chroot, /bin/su - prison  

we then create the file /bin/chroot-shell within our jail as the shell the user must use when he connects with ssh. The content is:

/usr/bin/sudo /usr/bin/chroot /jail/ /bin/su - $USER "@"  

The interesting part ist, that neither /usr/bin/sudo nor /bin/chroot are copied into the /jail/.
And linke expected: when the user tries to log in with sftp (WinSCP for example) it workes. But when he tries to use a terminal on SSH (with Putty for example) then it failes with the following line:

sudo: unknown uid 1001: who are you?

So my questions are:

  1. Isn't this way of configuring a chroot jail a unsecure one? putting a jailed person in the sudo config file does not appear meaningful to me. So what is the idea behind it? Why not just copy /bin/bashto the jail and let the user use this instead of the own bin/chroot-shell and the sudo entry?
  2. If this way somehow is more secure then using /bin/bash, then how can I make it work? I think the first step would be to copy /usr/bin/sudo and /usr/bin/chroot to the jail directory, right? but what next? sudo does not know the user ...

Thanks for all your help and sorry for my bad english.

Until now I have no idea, why the author of the article I read wanted to create an own shell and give the user in the jail sudo rights for some commands.
But the article was from 2008, so a little bit outdated.
I now put the /bin/bash Shell as the default shell for jailed users (with the chsh command). Also I had to make sure, that the libs /lib/libdl.so.2 /lib/libc.so.6 /lib/ld-linux.so.2 (in my case both 32bit and 64bit) are all three in the jail, so a jailed user had a proper username. Because without these there is no proper way to get the username out of the user id within the paswd file.
After that the users could open a proper ssh connection with a working shell and the command line knew who they are (the präfix name at the beginning of the line and also the whoami command).
That's it, now everything is working just fine^^

  • What is for the jail, and why would you want there an interactive user? It seems rather obvious to me also you do not want nor need the chroot binary there. – Rui F Ribeiro Nov 18 '15 at 11:35
  • I agree with the chroot binary. but what does the author thought by putting the /usr/bin/sudo /usr/bin/chroot /jail/ /bin/su - $USER "@" line in there? Wouldn't it the best just to set the /bin/bash as shell in the jail and ignore the sudo file and the /bin/chroot-shell? I really don't know how this shell would work and what the point of it is. – christopher2007 Nov 18 '15 at 11:53
  • agreed, all the jumps to chroot AND to a different user have to be done outside the jail and before handing over the control to chroot e.g. chroot -u user – Rui F Ribeiro Nov 18 '15 at 13:46
  • thanks a lot, everything is working fine now. I uses a copy of the /bin/bash shell and no sudo entries :) – christopher2007 Nov 18 '15 at 17:54
  • would you please write the answer for the benefit of future readers? – Rui F Ribeiro Nov 18 '15 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.