topic Re: sftp chroot help... in Operating System - HP-UX

sftp chroot help...

MikeL_4 — Thu, 01 Oct 2009 16:27:44 GMT

I have sftponly setup on a server and not having any issue with it, as the id being used can only use sftp...

I do need to lock the id into there home directory, right now they can move around where ever they want to..

Can you assist with this setup...

user id for sftp only account:
mpxsftp:x:113:116:chrooted user:/home/centftp/prod/00036_mpx/incoming:/bin/sftponly

I am running HP-UX 11.11 and following Secure Shell Version:
T1471AA A.05.10.006 HP-UX Secure Shell

Thanks

Re: sftp chroot help...

TTr — Thu, 01 Oct 2009 17:43:26 GMT

http://docs.hp.com/en/5900-0430/5900-0430.pdf
It briefly mentions the ssh and chroot environments and prompts you to read the README.hp file under /opt/ssh. There is also a script to make the conversion of a regular account to a chrooted account, /opt/ssh/utils/ssh_chroot_setup.sh

Have you looked at these?

Re: sftp chroot help...

MikeL_4 — Thu, 01 Oct 2009 18:00:23 GMT

I tried the script, and it made no difference...

Only thing I can see that it did was take away the sftponly and changed it to /bin/sh

I could still move around to other file systems.

Re: sftp chroot help...

Ivan_86 — Thu, 01 Oct 2009 21:13:42 GMT

Please check the document page 47

Regards

Re: sftp chroot help...

MikeL_4 — Fri, 02 Oct 2009 11:22:13 GMT

Followed instruction as indicated, and it all works fine, except that I can still do a cd /, and when I do I am in / and not this users home directory....

mpxsftp:x:113:116:chrooted user:/home/centftp/prod/00036_mpx/incoming/./home/mpxsftp:/bin/sftponly

=>sftp mpxsftp@tstsrvr
Connecting to tstsrvr...
Password:
sftp> pwd
Remote working directory: /aftp/reformaster/home/centftp/prod/00036_mpx/incoming/home/mpxsftp
sftp> ls
bin opt usr
sftp> cd /
sftp> pwd
Remote working directory: /
sftp> ls
2 aftp apps auto
autoemh autoemh2 autoemh3 autoemh4
autoemh5 autoemh6 bin ca_lic
cnpuref1 cust dev emh
etc etrust export fonts.alias
fonts.dir ftp home home2
lib lost+found mnt monitor
net opt orderofscript.txt osg1
prod realtime root sbin
sources stand tmp tmp_mnt
umount_uref1vg01 uref1vg01.mapfile uref1vg01.outfile usr
var vgdisplay.uref1vg01
sftp> quit
=>