Re: Jailing SSHd

From: Pat Lashley (patl+freebsd@volant.org)
Date: 06/29/02 

Date: Fri, 28 Jun 2002 18:34:04 -0700
From: Pat Lashley <patl+freebsd@volant.org>
To: Poul-Henning Kamp <phk@critter.freebsd.dk>

--On Saturday, June 29, 2002 12:28:35 AM +0200 Poul-Henning Kamp=20
<phk@critter.freebsd.dk> wrote:

> In message <2849830000.1025137373@mccaffrey.phoenix.volant.org>, Pat
> Lashley wr ites:
>>
>> --On Wednesday, June 26, 2002 09:07:36 PM +0200 Poul-Henning Kamp=3D20
>> <phk@critter.freebsd.dk> wrote:
>>
>>> Which reminds me that we should really tweak the code and put it in a
>>> jail instead of a chroot.
>>
>> Careful there. Some of us are using SSH to log into jails running
>> virtual hosting environments. The default installation needs to be able
>> to run if it is already within a jail when sshd is started.
>
> You could just fall back to chroot(2) if jail(2) failed.

My point is that the DEFAULT installation and configuration must Do
The Right Thing whether it is run in a jail or in the main server
environment. An acceptable solution would be a startup script which
was either smart enough to recognize when it is running in a jail,
or which implements a chroot fallback if the attempt to jail the sshd
fails.

-Pat

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: FTP guest access chroot not working
    ... the "root" dir for the chroot is /home/someguy/ftp ... # chroot ftp users ... cannot get out of that jail. ... if you created a symlink inside the jail that points to some real ...
    (comp.unix.sco.misc)
  • Re: /devices jailbreak
    ... however as duplicating device special files does /not/ ... processes in a chroot env will ... duplicates in the chrootjail ultimately lead to the same actual ... But that path will be in the chrootjail, as far as the jailed process ...
    (comp.unix.solaris)
  • Re: /devices jailbreak
    ... processes in a chroot env will ... outside the chroot environment will of course report the device paths ... within the jail as a normal user with the restricted Korn ... directory tree, as expected, except for a couple /devices files ...
    (comp.unix.solaris)
  • Re: /devices jailbreak
    ... however as duplicating device special files does /not/ ... processes in a chroot env will ... duplicates in the chrootjail ultimately lead to the same actual ... But that path will be in the chrootjail, as far as the jailed process ...
    (comp.unix.solaris)
  • sshd + jail (was Re: OpenSSH Security)
    ... > jail instead of a chroot. ... For a custom application I modified the sshd source to make ... a jail() call right after the username had been transferred. ... I considered subitting my patches, but to be honest, I wasn't ...
    (FreeBSD-Security)