1

I've followed the steps outlined here to create a chrooted sftp environment. Everything works great EXCEPT for the command ls. When I do an ls, with any of the flags, I get disconnected immediately.

When I do an strace on the PID, I get this (couldn't get it looking better than this.

Any ideas? I'm at wits ends.

`Process 7071 attached - interrupt to quit
 select(5, [3], [], NULL, NULL)          = 1 (in [3])
 read(3, "\0\0\0\n\v\0\0\0\2\0\0\0\1/", 16384) = 14
 open("/", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 5
 select(5, [3], [4], NULL, NULL)         = 1 (out [4])
 write(4, "\0\0\0\rf\0\0\0\2\0\0\0\4\0\0\0\0", 17) = 17
 select(5, [3], [], NULL, NULL)          = 1 (in [3])
 read(3, "\0\0\0\r\f\0\0\0\3\0\0\0\4\0\0\0\0", 16384) = 17
 getdents(5, /* 3 entries */, 32768)     = 80
 lstat("/.", {st_mode=S_IFDIR|0750, st_size=4096, ...}) = 0
 stat("/etc/localtime", 0x7fff44193d90)  = -1 ENOENT (No such file or directory)
 open("/etc/localtime", O_RDONLY)        = -1 ENOENT (No such file or directory)
 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 open("/etc/group", O_RDONLY|O_CLOEXEC)  = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 lstat("/..", {st_mode=S_IFDIR|0750, st_size=4096, ...}) = 0
 open("/etc/localtime", O_RDONLY)        = -1 ENOENT (No such file or directory)
 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 open("/etc/group", O_RDONLY|O_CLOEXEC)  = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 lstat("/attreport", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
 open("/etc/localtime", O_RDONLY)        = -1 ENOENT (No such file or directory)
 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 open("/etc/group", O_RDONLY|O_CLOEXEC)  = -1 ENOENT (No such file or directory)
 socket(PF_FILE, SOCK_STREAM, 0)         = 4
 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
 fcntl(4, F_GETFL)                       = 0x2 (flags O_RDWR)
 fcntl(4, F_SETFL, O_RDWR)               = 0
 connect(4, {sa_family=AF_FILE, path="/var/lib/pbis/.lsassd"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 getdents(5, /* 0 entries */, 32768)     = 0
 select(5, [3], [4], NULL, NULL)         = -1 EBADF (Bad file descriptor)
 sendto(7, "<83>Feb 27 22:02:23 sshd[7071]: "..., 66, MSG_NOSIGNAL, NULL, 0) = -1 EBADF (Bad file descriptor)
 close(7)                                = -1 EBADF (Bad file descriptor)
 socket(PF_FILE, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
 connect(4, {sa_family=AF_FILE, path="/dev/log"}, 110) = -1 ENOENT (No such file or directory)
 close(4)                                = 0
 exit_group(2)                           = ?
 Process 7071 detached

`

2
  • When you say everything works great, that includes downloading a file, right? Any idea what /var/lib/pbis/.lsassd is? Feb 27, 2012 at 22:50
  • Yup - I can upload, download, pwd - everything but ls. It appears that /var/lib/pbis/.lsassd is a likewise file, so AD authentication.
    – Greg Cain
    Feb 27, 2012 at 23:21

4 Answers 4

4

This ended up being an issue with Likewise Open. "ls" was the only command that try to resolve UID/GID when sftp'ing, and in doing so, it went to likewise for resolution, and as soon as it did, it crashed.

/etc/nsswitch.conf was setup to use files first:

passwd:     files lsass
shadow:     files
group:      files lsass

but for some reason it still went to likewise. The solution was to add the correct group to "RequireMembershipOf", which for RHEL6 was in /opt/likewise/bin/lwconfig.txt

3
  • From what I can find, it looks like answering your own question is acceptable. If it's not, please let me know.
    – Greg Cain
    Mar 7, 2012 at 17:49
  • 1
    From what I can see in your strace it failed to open /etc/group. Do you run in a chroot-environment?
    – Nils
    Mar 7, 2012 at 19:59
  • Yes, it is chrooted. I'll clarify the question.
    – Greg Cain
    Mar 7, 2012 at 20:37
1

Had the same problem, but running on RHEL 5.5.
Openssh-server 5.x using internal chroot with the match statement and pbis AD integration. Found two work-arounds:

  1. Change the passwd and group lines in /etc/nsswitch.conf from:

    passwd:     files lsass
    

    to look like:

    passwd:     files [UNAVAILABLE=return] lsass
    
  2. Create /etc/passwd and /etc/group files in the root of the chrooted environment. The files only need to hold the minimum amount of records based on the owners of the underlying files and directories.

0

If you run sftp only you can configure your sshd to use the internal sftp. That sftp will have all commands built in in a minimal version - the chroot just needs /dev/null, zero, random, urandom to work. ls will be a built-in command there as well.

No messing around with keeping your binaries and libraries in chroot up to date any more...

3
  • That's what I was doing. ls wasn't working in that scenario because of the likewise issue above.
    – Greg Cain
    Mar 7, 2012 at 21:50
  • Interesting. So ls tries to resolve UID and GID to names in that environment, too.
    – Nils
    Mar 8, 2012 at 16:22
  • Apparently so. I copied the /etc/passwd and /etc/group to the chrooted environment, but it didn't help.
    – Greg Cain
    Mar 8, 2012 at 17:14
0

For me, a similar error with sftp ls failing via chroot, and sftp get succeeding, was solved with copying /etc/group and /etc/passwd to my chroot. No files from /dev seem necessary. No changes in /etc/nsswitch.conf seem necessary, although I do chroot to remote cifs mount.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.