1

I'm trying to create an sshkey to send to a vendor so they can connect to their chrooted jailed folder: /home/jail/home/ The folder setup and permissions are all set to that specific user, lets say "user1" user1:user1

Whenever I create a key with ssh-keygen, it always lists the root user at the bottom of the .pub as root@system. I don't want the vendor connecting as root, rather have them connect as user1 so they only have access to their chrooted directory. The user accounts do not have login creds as I only want them to login with sshkeys so they can sftp their data to the drop folder.

I can't create the key on the user1 account as its privileges are very minimal and they can't even run ssh-keygen. Everything else I'm trying just set it to root@system since that's the account I'm logged in as. This has to be a common practice but I can't figure this out. I was assuming that I would put the .pub of the pair in the chrooted authorized_hosts file and then securely send them the private key to use to connect via SFTP and drop off their files.

Everything works properly if I try to sftp using: sftp -i file user1@dropserver.server.com. However, I can also just do sftp -i file ROOT@dropserver.server.com and it lets me in there with root permissions. I just need to stop the vendor from being able to just use root as the username and bypass the chroot.

|improve this question
4

Anything after the actual public key itself in the .pub file is actually just a comment; it usually defaults to username@hostname for the user who created the key and the host on which it was created. It can be removed entirely or replaced with a comment indicating its role as a jailed single-user key:

ssh-rsa [HASH GOES HERE] root@myhost

could be:

ssh-rsa [HASH GOES HERE] Special keypair jailed shell access

This can be done at creation with the -C switch. Quoth man ssh-keygen:

 -C comment
         Provides a new comment.

So, if I were to ssh-keygen -C "This is a comment", the public key would appear as:

ssh-rsa [HASH] This is a comment
|improve this answer
  • Good to know! I started to think that for a bit a moment ago and tried to just add the .pubkey in to the auth_keys in the user1 jailed directory. When I tried to SSH in using the identity file and user1@serverdrop.server.com is put me in the right place and I was jailed. However, when I tried to do the same thing as root@serverdrop.server.com it let me in as root. Is there anyway that I can only allow user1 to use that key... or, make it so that key only allows someone to that specific directory? – saleetzo Mar 29 '17 at 20:43
  • Easy enough -- don't have that key listed in root's authorized_keys file? – DopeGhoti Mar 29 '17 at 20:45
  • The .pub for user1 is not listed in the /root/.ssh/authorized_keys file -- that one is totally blank. – saleetzo Mar 29 '17 at 20:51
  • All is good now in this town!!! Long days and short nights make the mind get nutty -- i had another term open that was logged in as root... that is why i was authing through it. Thanks @DopeGhoti – saleetzo Mar 29 '17 at 22:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.