Set up chroot for LDAP users in RHEL6

Question

I have been working on this for 2 days now and am about to give up so someone please help.

I have a Red Hat 6 server joined to my active directory domain. Logins work just fine under normal circumstances. I have SSH login restricted to specific active directory groups by using require_membership_of= in the file/etc/security/pam_winbind.conf. It works great.

Now I need to lock those users to only have access to their home directory (chroot) and only allow sftp logins.

I have tried about a billion combinations of editing the /etc/ssh/sshd_config file but either end up with the user not being restricted to their home folder or them not being able to log in. The below configuration works just fine when I use local users/groups to restrict chroot and sftp login. (obviously I change the Match group to the local user group)

The problem I think I have is the fact that LDAP users are not local users and they don't have local groups. Here is the relevant section of my sshd_config file

  Match group 'Domain Users'
    ChrootDirectory %h
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp

When I restart sshd this give an error /etc/ssh/sshd_config line 135: Bad Match condition When I change 'Domain Users' to Domain\040Users I don't get the error but LDAP users are not restricted to their home directories (chroot isn't working). I also tried changing the ChrootDirectory %h to a new /chroot folder as well as /home/%u but both did not work.

The possible solutions I have thought of are

• Change the default group LDAP users are a part of (I haven't found this anywhere and the settings is /etc/default/useradd don't apply)
• Change the Match group in the sshd_config file to something that DOES apply to domain users. I tried 'Domain Users', Domain\ Users, Domain\040Users, and the SID from LDAP of the Domain users group. All of which did not work or gave errors when restarting sshd
• Upon first login have the system create a local user/group (but this may break password syncing to AD
• Something else I have missed completely.

Does anyone have experience with setting up chroot restrictions with LDAP logins? I am at a loss and don't think I can open any more tabs in my browser.

Answer 1

Thanks to TrevorH1 in the #centos channel I was able to get this to work.

The way you can match a group with spaces (in my case Domain Users) is to use the ? to represent space (a standard shell glob pattern). This would match any group that also has any character instead of a space but it works for my needs.

For example my new sshd_config looks like this

 Match Group domain?users
  ChrootDirectory %h
  X11Forwarding no
  AllowTcpForwarding no
  ForceCommand internal-sftp

It was also important for me to use lower case characters instead of Domain?Users. Even though the group in LDAP is uppercase. The way you can figure out what group you need to filter by is by using id <username> This will give you a list of all the groups that user is a part of. If I had multiple groups is LDAP (e.g. domain-users, domain!users, domainsusers) this would match all of those cases as well which may or may not be desired.

Answer 2

You can try this Match Group "domain users". It worked for me. Even I am using this more difficult syntax than you Match Group "WORKGROUP\domain users".