0

I try to restrict access to SFTP Only with one User Account. After Login there should some commands be executed.Therefore i inserted forcecommmand in my sshd_config:

Match group stream
   #ChrootDirectory /home/%u
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand sudo /etc/mountsftp.sh
   #ForceCommand internal-sftp

This works fine and my command Script:

#!/bin/bash
now=$(date +"%T,%D")
echo "Login : $now" >> /login.log
sshfs usrl@server:/usbshare1-2 /media/pp -o reconnect -o allow_other -o workaround=all
mount --bind /media/pp/Serien /home/stream/Serien
J=$HOME
#
#exit by calling a shell to open for the ssh session
#internal-sftp
#cp -v /usr/lib/openssh/sftp-server $J/bin/
chroot $J /usr/lib/openssh/sftp-server

is executed. But after the CHROOT its not possible to start the sftp-server, because its not found after chroot. But I need Chroot as well as this sftp-server. Is there any way to accomplish this?

PS: Autofs for the mount is no option, because everything is executed on an vserver without the needed Kernel modules.

0

Copy the sftp-server binary and all its dependencies (ldd /usr/lib/openssh/sftp-server) to the chroot and you will be able to run it.

  • I tried this, my chroot directory got this tree: |-- bin | |-- bash | -- sftp-server |-- dev | -- null |-- etc | |-- hosts | |-- ld.so.cache | |-- ld.so.conf | -- nsswitch.conf |-- lib | -- x86_64-linux-gnu | |-- libc.so.6 | |-- libdl.so.2 | -- libtinfo.so.5 |-- lib64 |-- mountsftp.sh |-- Serien but i get this error: chroot: failed to run command ‘/usr/lib/openssh/sftp-server’: Not a directory – user154501 Nov 4 '16 at 15:21
  • Please, edit the question with details what you tried. It is not readable in the comments. – Jakuje Nov 6 '16 at 8:12
  • You also probably need to run the command chroot with correct path to the binary you copied: `chroot $J $J/sftp-server – Jakuje Dec 20 '16 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.