How do you chroot your openssh users

[Steven E. Protter]

I need to chroot sftp users in Linux.

Every approach has a pitfall.

One recompiles openssh and I want to use stock redhat.

I've tried this:
http://rpmfind.net//linux/RPM/dag/redhat/el4/i386/jailkit-1.3-1.2.el4.rf.i386.html

I had a working configuration and user add script but I managed to broke it and lost my script.

So what do you do?

Anyone using the jailkit v1.3 or v2.0 above having a valid user add script gets a bunny.

SEP

[Rob Leadbeater]

Hi SEP,

Been there, tried that, and couldn't figure it out :-(

I was trying to set up a Fedora box to support chrooted FTP users (vsftpd) as well as sftp, and whichever way I tried something else would fail...

In the end I balanced up the security risk and left the sftp users not chrooted, and used the builtins of vsftpd to control chrooting of the standard ftp users. Not ideal though.

I'm sure it must be possible somehow ...

Regards,

Rob

[Ivan Ferreira]

I tried also and I think that chrooting user environment for scp it's too complex to manage (in your case, you lost your script and you have problems).

I really prefer to use vsftpd with SSL encription, provided by vsftpd itself. Configure chroot users in vsftpd is very easy, just like ftpusers (I think you already know this).

[Steven E. Protter]

Correct Ivan.

A procedure for SSL and vsftp has point value here. Is the authentication in such a scheme also encrypted?

SEP

[Steven E. Protter]

Shalom,

I had this working perfectly on my desktop linux box at work.

Then I walloped it with Centos 5 and forgot to back up my script. Now I'm unsure which is more stable 1.3 or 2.0 or which I used.

http://rpmfind.net//linux/RPM/dag/redhat/el4/i386/jailkit-2.0-1.el4.rf.i386.html

SEP

[Ivan Ferreira]

>> A procedure for SSL and vsftp has point value here. Is the authentication in such a scheme also encrypted?

Yes. It works like https. I can't find a quick guide about how to set up it, I have it in spanish, but FAIK you won't have problems finding the information.

[Steven E. Protter]

Fair enough.

I'll run some tests.

Hebrew is hard enough. I can live without a procedure in Spanish.

Pienso que lo leería algo en inglés

Ani Choshev ani ohaiv l'kro b'anglist

SEP

[Court Campbell]

SEP,

check this out:

http://209.85.165.104/search?q=cache:N_aul1dNFpEJ:www.opensourcehowto.org/how-to/fedora/vsftpd--openssl--net2ftp.html+howto+vsftpd+ssl&hl=en&ct=clnk&cd=5&gl=us

Had to send a cached version as the corporate proxy has blocked the site.

[Court Campbell]

Also this may help. I haven't read all the code, but it looks promising.

http://www.fuschlberger.net/programs/ssh-scp-sftp-chroot-jail/make_chroot_jail.sh.html

[Heironimus]

Not exactly what you're asking for, but have you looked in to using scponly or rssh instead of jailkit to help support your chroot environment? They're one trick ponies, you can't use them to chroot anything else but you can safely assume that their documentation will apply to sftp.