SFTP server on RHEL6 disconnects on ls

Question

I've followed the steps outlined here to create a chrooted sftp environment. Everything works great EXCEPT for the command ls. When I do an ls, with any of the flags, I get disconnected immediately.

When I do an strace on the PID, I get this (couldn't get it looking better than this.

Any ideas? I'm at wits ends.

`Process 7071 attached - interrupt to quit
 select(5, [3], [], NULL, NULL)          = 1 (in [3])
 read(3, "\0\0\0\n\v\0\0\0\2\0\0\0\1/", 16384) = 14
 open("/", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 5
 select(5, [3], [4], NULL, NULL)         = 1 (out [4])
 write(4, "\0\0\0\rf\0\0\0\2\0\0\0\4\0\0\0\0", 17) = 17
 select(5, [3], [], NULL, NULL)          = 1 (in [3])
 read(3, "\0\0\0\r\f\0\0\0\3\0\0\0\4\0\0\0\0", 16384) = 17
 getdents(5, /* 3 entries */, 32768)     = 80
 lstat("/.", {st_mode=S_IFDIR|0750, st_size=4096, ...}) = 0
 stat("/etc/localtime", 0x7fff44193d90)  = -1 ENOENT (No such file or directory)
 open("/etc/localtime", O_RDONLY)        = -1 ENOENT (No such file or directory)
 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 open("/etc/group", O_RDONLY|O_CLOEXEC)  = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 lstat("/..", {st_mode=S_IFDIR|0750, st_size=4096, ...}) = 0
 open("/etc/localtime", O_RDONLY)        = -1 ENOENT (No such file or directory)
 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 open("/etc/group", O_RDONLY|O_CLOEXEC)  = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 lstat("/attreport", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
 open("/etc/localtime", O_RDONLY)        = -1 ENOENT (No such file or directory)
 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 open("/etc/group", O_RDONLY|O_CLOEXEC)  = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 getdents(5, /* 0 entries */, 32768)     = 0
 select(5, [3], [4], NULL, NULL)         = -1 EBADF (Bad file descriptor)
 sendto(7, "<83>Feb 27 22:02:23 sshd[7071]: "..., 66, MSG_NOSIGNAL, NULL, 0) = -1 EBADF (Bad file descriptor)
 close(7)                                = -1 EBADF (Bad file descriptor)
 socket(PF_FILE, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
 connect(4, {sa_family=AF_FILE, path="/dev/log"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 exit_group(2)                           = ?
 Process 7071 detached

`

Answer 1

This ended up being an issue with Likewise Open. "ls" was the only command that try to resolve UID/GID when sftp'ing, and in doing so, it went to likewise for resolution, and as soon as it did, it crashed.

/etc/nsswitch.conf was setup to use files first:

passwd:     files lsass
shadow:     files
group:      files lsass

but for some reason it still went to likewise. The solution was to add the correct group to "RequireMembershipOf", which for RHEL6 was in /opt/likewise/bin/lwconfig.txt

Answer 2

Had the same problem, but running on RHEL 5.5.
Openssh-server 5.x using internal chroot with the match statement and pbis AD integration. Found two work-arounds:

1. Change the passwd and group lines in /etc/nsswitch.conf from:

   passwd:     files lsass
   

   to look like:

   passwd:     files [UNAVAILABLE=return] lsass
   

2. Create /etc/passwd and /etc/group files in the root of the chrooted environment. The files only need to hold the minimum amount of records based on the owners of the underlying files and directories.

Answer 3

If you run sftp only you can configure your sshd to use the internal sftp. That sftp will have all commands built in in a minimal version - the chroot just needs /dev/null, zero, random, urandom to work. ls will be a built-in command there as well.

No messing around with keeping your binaries and libraries in chroot up to date any more...

Answer 4

For me, a similar error with sftp ls failing via chroot, and sftp get succeeding, was solved with copying /etc/group and /etc/passwd to my chroot. No files from /dev seem necessary. No changes in /etc/nsswitch.conf seem necessary, although I do chroot to remote cifs mount.