Secure Shell update broke chroot environment

[Alex Wanderley]

Hi,

This is on 11.11i v1.
After udating Secure Shell from A.04.70.009 to A.05.00.024 chroot ssh, sftp and scp environments stopped working. The account can login, but it doesn't get "jailed" to its home directory.
I successfully created a brand new test environmemt/account with the /opt/ssh/utils/ssh_chroot_setup.sh script, but end up with the same behavior.
Just so you know, enabling he "ChrootDirectory" clause on /opt/ssh/etc/sshd_config didn't help because it made all accounts to chroot to that directory.
Has anybody had this problem before?

Thanks a lot,

Alex

[Ivan Krastev]

Hi Alex,

See known problems and workarounds for this version:
"The chroot functionality does not work if the UseLogin configuration directive in sshd_config is set to YES"

More here - http://docs.hp.com/en/T1471-90033/ch01s06.html

regards,
ivan

[Alex Wanderley]

Hi Ivan,

The UseLogin clause is actually set to its default: "no".
I tried actually making it explicit and restarting sshd, but it didn't work either.

But that's how it looks like: as if the "UseLogin" clause was set to "yes"...

Thanks,

Alex

[Alex Wanderley]

Hi there,

Just in case somebody experience the same issue, here the solution I got from HP. Note that this is for a chroot environment after that was there before the Secure Shell update.

1 - On the actual /etc/passwd file, change the chrooted account's home directory from "//./home/" to "/home/".
2 - Do the same for "//etc/passwd"
3 - On the end of the /opt/ssh/etc/sshconfig file add two lines like:
Match User
ChrootDirectory /
4 - Restart sshd.

Alex

[Alex Wanderley]

This thread is closed.