at the moment I am creating a chroot jail. Therefore I read some articles and everything seems to be clear, exept for one thing: the chroot jail shell
In one source they created the following setup (of course the setup is much bigger, but this is the part I have a question in):
The jail is set up with some programs and there libs.
The chroot jail folder is
Now we want to create the user prison within our new jail.
Therefore we open the file
/etc/sudoers and write the following line in it:
prison ALL=NOPASSWD: /usr/bin/chroot, /bin/su - prison
we then create the file
/bin/chroot-shell within our jail as the shell the user must use when he connects with ssh. The content is:
#!/bin/bash /usr/bin/sudo /usr/bin/chroot /jail/ /bin/su - $USER "@"
The interesting part ist, that neither
/bin/chroot are copied into the
And linke expected: when the user tries to log in with sftp (WinSCP for example) it workes. But when he tries to use a terminal on SSH (with Putty for example) then it failes with the following line:
sudo: unknown uid 1001: who are you?
So my questions are:
- Isn't this way of configuring a chroot jail a unsecure one? putting a jailed person in the sudo config file does not appear meaningful to me. So what is the idea behind it? Why not just copy
/bin/bashto the jail and let the user use this instead of the own
bin/chroot-shelland the sudo entry?
- If this way somehow is more secure then using
/bin/bash, then how can I make it work? I think the first step would be to copy
/usr/bin/chrootto the jail directory, right? but what next? sudo does not know the user ...
Thanks for all your help and sorry for my bad english.
Until now I have no idea, why the author of the article I read wanted to create an own shell and give the user in the jail sudo rights for some commands.
But the article was from 2008, so a little bit outdated.
I now put the
/bin/bash Shell as the default shell for jailed users (with the
chsh command). Also I had to make sure, that the libs
/lib/libdl.so.2 /lib/libc.so.6 /lib/ld-linux.so.2 (in my case both 32bit and 64bit) are all three in the jail, so a jailed user had a proper username. Because without these there is no proper way to get the username out of the user id within the
After that the users could open a proper ssh connection with a working shell and the command line knew who they are (the präfix name at the beginning of the line and also the
That's it, now everything is working just fine^^