SSH Chrooted Jail not working.

Søkka · 2012-11-23 10:24:16

Hello all,

I've been trying to set up a chrooted jail for SSH on my server. I've followed the following guide http://allanfeid.com/content/creating-c … ssh-access.

I set up everything to /var/jail as the guide stated, also I did append this to my sshd config (and restarted the sshd server):

Match Group inmates
          ChrootDirectory /var/jail/
          X11Forwarding no
          AllowTcpForwarding no

Match User tdf
	  ChrootDirectory /var/jail/
          X11Forwarding no
          AllowTcpForwarding no

I've tried both User and Group matching just to be sure. But when I ssh in with that user, I can still access my whole filesystem.

/var/jail is owned by root.root. I did

chown root.root /var/jail -Rfv

so it should be okay.. and I'm running OpenSSH_6.1p1 btw. Which supports the chroot directive afaik.

Also can I just setup the home directory of the user in /home or do I need to put it in /var/jail/home ?

Am I still missing something? I did search around but I can't seem to find anything that solves the problem. Thanks in advance :)

cfr · 2012-11-27 01:32:27

Does https://wiki.archlinux.org/index.php/Sshfs#Chrooting help at all?

Søkka · 2012-11-27 10:24:45

Thanks, but not entirely. I've got the Match User directive and tried to add the sftp line, but I need jailed ssh access. But when I add that line I get This service allows sftp connections only.. Which is correct, but not what I need.. When I try to SFTP it does give me a Could not retrieve file listing for "/". Make sure you have permission to modify this file.

Also, I tried ssh'ing again with the jailed user. And now I get this error :

 /bin/bash: Permission denied

When I try to change the shell in /etc/passwd to '/var/jail/usr/bin/bash', I also get

 /var/jail/usr/bin/bash: Permission denied

.

Which should be correct since they're owned by root.root as everywhere is advised. It's probably some small mistake somewhere, however I can't seem to pinpoint it..

Last edited by Søkka (2012-11-27 10:27:26)

hunterthomson · 2012-11-27 10:38:30

Side note:
You will also want to use the grsecurity patched kernel to make the Linux chroot into a Jail. Without the restrictions grsecurity puts on the Linux chroot... it is not a 'Jail'. That is, it dose not provide any 'security'. You do not have to enable any other of the grsecurity or PaX settings, just at least the chroot ones.

https://aur.archlinux.org/packages/linux-grsec/

CONFIG_GRKERNSEC_CHROOT=y
CONFIG_GRKERNSEC_CHROOT_MOUNT=y
CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
CONFIG_GRKERNSEC_CHROOT_PIVOT=y
CONFIG_GRKERNSEC_CHROOT_CHDIR=y
CONFIG_GRKERNSEC_CHROOT_CHMOD=y
CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
CONFIG_GRKERNSEC_CHROOT_MKNOD=y
CONFIG_GRKERNSEC_CHROOT_SHMAT=y
CONFIG_GRKERNSEC_CHROOT_UNIX=y
CONFIG_GRKERNSEC_CHROOT_FINDTASK=y
CONFIG_GRKERNSEC_CHROOT_NICE=y
CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
CONFIG_GRKERNSEC_CHROOT_CAPS=y

Last edited by hunterthomson (2012-11-27 10:42:17)

Arch Linux

#1 2012-11-23 10:24:16

SSH Chrooted Jail not working.

#2 2012-11-27 01:32:27

Re: SSH Chrooted Jail not working.

#3 2012-11-27 10:24:45

Re: SSH Chrooted Jail not working.

#4 2012-11-27 10:38:30

Re: SSH Chrooted Jail not working.

Board footer