topic Re: Secure Shell update broke chroot environment in Operating System - HP-UX

Secure Shell update broke chroot environment

Alex Wanderley — Tue, 16 Sep 2008 19:05:07 GMT

Hi,

This is on 11.11i v1.
After udating Secure Shell from A.04.70.009 to A.05.00.024 chroot ssh, sftp and scp environments stopped working. The account can login, but it doesn't get "jailed" to its home directory.
I successfully created a brand new test environmemt/account with the /opt/ssh/utils/ssh_chroot_setup.sh script, but end up with the same behavior.
Just so you know, enabling he "ChrootDirectory" clause on /opt/ssh/etc/sshd_config didn't help because it made all accounts to chroot to that directory.
Has anybody had this problem before?

Thanks a lot,

Alex

Re: Secure Shell update broke chroot environment

Ivan Krastev — Tue, 16 Sep 2008 19:50:11 GMT

Hi Alex,

See known problems and workarounds for this version:
"The chroot functionality does not work if the UseLogin configuration directive in sshd_config is set to YES"

More here - http://docs.hp.com/en/T1471-90033/ch01s06.html

regards,
ivan

Re: Secure Shell update broke chroot environment

Alex Wanderley — Tue, 16 Sep 2008 20:38:18 GMT

Hi Ivan,

The UseLogin clause is actually set to its default: "no".
I tried actually making it explicit and restarting sshd, but it didn't work either.

But that's how it looks like: as if the "UseLogin" clause was set to "yes"...

Thanks,

Alex

Re: Secure Shell update broke chroot environment

Alex Wanderley — Thu, 18 Sep 2008 20:51:07 GMT

Hi there,

Just in case somebody experience the same issue, here the solution I got from HP. Note that this is for a chroot environment after that was there before the Secure Shell update.

1 - On the actual /etc/passwd file, change the chrooted account's home directory from "//./home/" to "/home/".
2 - Do the same for "//etc/passwd"
3 - On the end of the /opt/ssh/etc/sshconfig file add two lines like:
Match User
ChrootDirectory /
4 - Restart sshd.

Alex

Re: Secure Shell update broke chroot environment

Alex Wanderley — Thu, 18 Sep 2008 20:52:59 GMT

This thread is closed.