1

The idea might be stupid or not feasible, I don't know, but I can't find any reference about this...

As you may know (and as SE definitely knows!), one of the common steps used to tighten SSH security, provided file access is enough, is to lock the user in a chroot. OpenSSH has been providing such a chroot-based jail for years now.

However that approach lacks flexibility (all-or-nothing, SFTP only, etc.) and it comes down to abusing a system call (which has security implications, hence the "the jail must be owned by root" and other recommendations rarely understood).

Now that OpenSSH is provided as a sshd.socket and sshd@.service, I am tempted to use Linux namespace (which I get for free then) to restrain my users instead.

I am just very surprise that I found literally nothing on that alternative scheme. So my question is, is there any reason not to use namespaces instead of chroot for that kind of usage?

closed as primarily opinion-based by Thomas Dickey, Romeo Ninov, Rui F Ribeiro, Eric Renouf, Stephen Rauch Aug 16 '17 at 12:15

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    "abusing" is a strange verb to associate with the standard chroot(2) system call – thrig Aug 15 '17 at 16:24
  • And that exact same man page explains at length that chroot purpose is not security: "chroot() changes the root directory of the calling process" and "This call changes an ingredient in the pathname resolution process and does nothing else." and "it is not intended to be used for any kind of security purpose". Hence, "abusing" in that specific context. :) – Eddy Aug 16 '17 at 14:18
  • I see that perfectly closed questions (at the end of my description, not my title) are also quickly flagged these days even though I find the (now accepted) answer spot on and perfectly acceptable. But I understand that black or white answers are far more appealing than grey ones. A shame though that people still confuse "complicated" and "subjective"... Semantically, one only needs 1 counter example to answer a "is there any reason not to..." type of question... A real shame... – Eddy Aug 16 '17 at 14:28
  • time wasted in comments might be better spent on the question e.g. instead of "why do people" (who?) a not-opinion "what are the advantages of linux namespaces vs. chroot", use a not-opinion verb instead of the strange abuse one, etc. – thrig Aug 16 '17 at 15:09
0

You should try that and report back how it works. In everything, there is somebody first one!

But my concern is that it would not work. The chroot from OpenSSH is called after all the key exchange, authentication and everything is done, but Systemd would force the namespaces even before starting the sshd process (if I understand its behavior correctly) and it might not be able to process the user authentication. Also in the service file, you are not able to differentiate users connecting so you would namespace all of them? How would you connect as a normal admin user to maintain this system? I believe it is certainly a good idea and useful for other services, but I don't believe you would be able to "abuse" it (for free) to suit your needs for OpenSSH.

  • I just assumed that sshd.socket did the authentication and just spawned sshd@<username>.service before forwarding the connection. It is indeed not the case which means that OpenSSH itself must be aware and use namespaces. Thank you. – Eddy Aug 16 '17 at 14:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.