0

Trying to use jailkit on Centos7. I've installed by source and also used RPM's at http://dries.eu/rpms/jailkit/jailkit, and get the same results. I am primarily following https://olivier.sessink.nl/jailkit/howtos_chroot_shell.html, however, have also looked at many other documents.

Step 1: Creating the Jail. Should I also include jk_lsh? More on this later. Also, not a big deal, but do you recommend using the -k option to make links instead of copying them? Note that several files did not exist.

[root@mybox ~]# jk_init -v -j /home/jail basicshell editors extendedshell netutils ssh sftp scp | grep 'do not exist'
Source file(s) /lib/libnsl.so.1 do not exist
Source file(s) /lib/libnss*.so.2 do not exist
Source file(s) /etc/bash.bashrc do not exist
Source file(s) /usr/lib/locale/en_US.utf8 do not exist
Source file(s) /etc/vimrc do not exist
Source file(s) /etc/joe do not exist
Source file(s) /etc/bash.bashrc do not exist
Source file(s) /usr/lib/locale/en_US.utf8 do not exist
Source file(s) /usr/share/mc do not exist
Source file(s) /etc/vimrc do not exist
Source file(s) /etc/joe do not exist
Source file(s) /lib/libnss_dns.so.2 do not exist
Source file(s) /usr/lib/sftp-server do not exist
Source file(s) /usr/lib/misc/sftp-server do not exist
Source file(s) /usr/libexec/sftp-server do not exist
Source file(s) /usr/lib/openssh/sftp-server do not exist
Source file(s) /usr/lib/sftp-server do not exist
Source file(s) /usr/lib/misc/sftp-server do not exist
Source file(s) /usr/libexec/sftp-server do not exist
Source file(s) /usr/lib/openssh/sftp-server do not exist
[root@mybox ~]#

Step 2: Adding user to the jail. Can't add a user as /usr/sbin/jk_lsh wasn't added. I can either add it using jk_init, or specify the shell for the user using -s /bin/bash (which seems appropriate as later need to change it). I've tried both.

[root@mybox ~]# jk_jailuser -m -v -j /home/jail testuser1
invalid shell, /home/jail/usr/sbin/jk_lsh does not exist
enter jail directory: /home/jail
invalid shell, /home/jail/usr/sbin/jk_lsh does not exist
enter jail directory: ^C
aborted..
[root@mybox ~]#
# add jk_lsh and jail users...
[root@mybox ~]# cat /etc/passwd | grep testuser
testuser1:x:1002:1002::/home/jail/./home/testuser1:/usr/sbin/jk_chrootsh
testuser2:x:1003:1003::/home/jail/./home/testuser2:/usr/sbin/jk_chrootsh
[root@mybox ~]# cat /home/jail/etc/passwd
root:x:0:0:root:/root:/bin/bash
testuser1:x:1002:1002::/home/testuser1:/usr/sbin/jk_lsh
testuser2:x:1003:1003::/home/testuser2:/bin/bash
[root@mybox ~]#

Step 3: Log on as new user. Attempting to log on as either testuser1 or testuser2, the shell is immediately closed.

[root@mybox ~]# tail -6 /var/log/secure
Sep  7 14:12:24 mybox sshd[2615]: Accepted password for testuser1 from 11.22.333.444 port 62008 ssh2
Sep  7 14:12:24 mybox sshd[2615]: pam_unix(sshd:session): session opened for user testuser1 by (uid=0)
Sep  7 14:12:24 mybox sshd[2615]: pam_unix(sshd:session): session closed for user testuser1
Sep  7 14:12:36 mybox sshd[2623]: Accepted password for testuser2 from 11.22.333.444 port 62009 ssh2
Sep  7 14:12:36 mybox sshd[2623]: pam_unix(sshd:session): session opened for user testuser2 by (uid=0)
Sep  7 14:12:37 mybox sshd[2623]: pam_unix(sshd:session): session closed for user testuser2
[root@mybox ~]#

My Hack Workaround: When installing from source and using jk_init -k .., I executed jk_cp -v -f -j /home/jail /bin/bash before adding a user, and doing so prevented the shell from immediately closing. Not sure why this is necessary, or whether the -k flag or needing to do from source made the change. Regardless, it seems to me needing to do this step probably is a poor workaround.

Last Minor Issue: Not a big deal, but also get these errors when updating:

[root@mybox ~]# jk_update -j /home/jail -d
ERROR:  while scannign dir /home/jail/lib/: No such file or directory
ERROR:  while scannign dir /home/jail/opt/: No such file or directory
[root@mybox ~]#

My Question: What is the proper way to jail a user so the shell doesn't immediately close?

0

You may try this, it's easy to use.

you can set a user into jail within only 3 steps.

1. add user to system
2. create a jail with jail-shell command.
3. set user into jail with jail-shell command.

Here is the tool: https://github.com/pymumu/jail-shell

NOTE: I'm the developer of this tool, so this is a bit of self promotion.

Nick Peng = pymumu

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.