topic Re: chroot - sftp - RedHat ES4 in Operating System - Linux

chroot - sftp - RedHat ES4

Jeff Hoevenaar — Wed, 07 Sep 2005 08:16:47 GMT

I am trying to create a chroot environment for users using sftp.

I have found many different examples on how to set this up but none of them seem to work. I also found /etc/security/chroot.conf but no documentation on it.

Has anyone done this and got it to work.

Thanks!

Re: chroot - sftp - RedHat ES4

Jeff Hoevenaar — Wed, 07 Sep 2005 08:58:10 GMT

One more thing - how can a limit which users are allowed to sftp to my server?

Re: chroot - sftp - RedHat ES4

Gopi Sekar — Wed, 07 Sep 2005 09:14:43 GMT

For your second requirement:

Check for 'AllowUsers' and 'DenyUsers' configuration parameters for /etc/ssh/sshd.config file

for more information on this 'man sshd_config'

I don't know much about how to do the first requirement

Regards,
Gopi

Re: chroot - sftp - RedHat ES4

Ivan Ferreira — Wed, 07 Sep 2005 14:30:31 GMT

For using sshd with chroot, you will need a patch. See:

http://chrootssh.sourceforge.net/index.php

I don't know if you can selectively enable chroot for sftp only, not for ssh, or viceversa.

What I know is that the vsftpd has chroot capabilities and works very well. Also, you can secure the comunication of the vsftpd server using SSL/TLS.

Re: chroot - sftp - RedHat ES4

Jeff Hoevenaar — Wed, 07 Sep 2005 14:47:31 GMT

I got this to work by modifying /etc/pamd/ssh and /etc/security/chroot.conf and /etc/ssh/sshd_config.

http://www.tokkee.de/howtos/chrooted_ssh_howto.pdf

Re: chroot - sftp - RedHat ES4

Julien Mioni — Thu, 08 Sep 2005 13:03:22 GMT

I made it work on a Fedora Core 3 using this howto :
http://gentoo-wiki.com/HOWTO_SFTP_Server_(chrooted,_without_shell)

But users can always use the "!command" to send shell commands. Do somebody know how to remove this option ?

julien

Re: chroot - sftp - RedHat ES4

Julien Mioni — Thu, 08 Sep 2005 13:05:08 GMT

PS : I'll try your howto tomorrow Jeff
Julien

Re: chroot - sftp - RedHat ES4

Jeff Hoevenaar — Tue, 13 Sep 2005 10:14:10 GMT