Re: OpenSSH & ChRoot

From: Darren Tucker (dtucker_at_zip.com.au)
Date: 05/22/05

  • Next message: Alexander Klimov: "Re: workarounds for Host param not canonicalizing?" 
    Date: Sun, 22 May 2005 22:45:25 +1000
To: Richard Secor <rsecor@seqlogic.com>

    Richard Secor wrote:
    [sshd and chroots]
    > I'm sure someone will try and explain to me why I don't need to ChRoot
    > in SSH, but I want to do it, and with SSH I can. That should be enough
    > to find out how to do it with OpenSSH (otherwise I'm stuck with SSH,
    > until something comes along)

    Stock OpenSSH doesn't have a native chroot capability (not sure about's
    FreeBSD's but I suspect it doesn't either), however if FreeBSD has
    pam_chroot then that ought to work (it did on Linux last time I tried it). 

    -- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
  • Next message: Alexander Klimov: "Re: workarounds for Host param not canonicalizing?"

    Relevant Pages

    • Re: Need advice on setting of an SSH server for untrusted users
      ... > I've just set up an ssh server so that my customers can download code ... I've set up ssh so that it requires rsa authentication. ... There is a patch for openssh that will cause it to do a chroot like ... The issue with a chroot jail for ssh is that you have to hand-roll the ...
      (comp.os.linux.security)
    • Re: Problems with Sudo
      ... you can't sudo to root. ... SSH is generally allowed, all limitations should still apply including ... secure, the internet is a very dangerous place. ... allowing someone to break out of a chroot jail by simply logging back ...
      (Ubuntu)
    • Re: sftponly
      ... provided the server is secure or what other services/interfaces you ... > I agree - chrooting is a good practice, and I wouldn't set SSH up without ... > you pair them with a chroot jail. ... Of course they can do more with SSH access, ...
      (SSH)
    • Re: Chroot environment for ssh
      ... > would like to use SSH for the connections, as opposed to FTP, but I ... > users to be able to log into an interactive shell and I ... > want them to 'escape' out of their home directories. ... directives to chroot the groupand/or userthat are to have ...
      (FreeBSD-Security)
    • sftp with chroot
      ... chroot, so that users can be jailed to their home folder only. ... But sftp does not restrict to ... I tried to patch the Openssh 4.3p2 source code from openssh.org as given ... No output written to ssh ...
      (SunManagers)