RE: How to bypass /etc/passwd's shell

From: Marcus Zoller (Marcus.Zoller_at_idnt.net)
Date: 07/18/01

On Wed, 18 Jul 2001, Boda Karoly jr. wrote:

> On Wed, 18 Jul 2001, Andrew Hatfield wrote:
>
> > you could also set the shell to be /bin/rbash
> > rbash is a sym link to /bin/bash
>
> But it's possible to get out from this chroot.
>
> woockie_at_twoflower:~$ cd ..
> rbash: cd: restricted
> woockie_at_twoflower:~$ vi foo
>
> in vi:
> :set shell=/bin/sh
> :shell
> woockie_at_twoflower:~$ cd ..
> woockie_at_twoflower:/home$
>

I don't know if this is what you need (I've didn't read the whole
thread)...

This is somewhat more work but it runs fine and I guess you can't get out
of it:

... you can copy a minimum rootfs to the home
directory... (don't forget to mount /proc inside,
a dummy mtab and fstab, resolv.conf, ...)

create a script, e.g. /bin/rshell with:

#!/bin/sh
/usr/sbin/chroot /home/<user chroot> /bin/bash -login

This becomes the new login shell in /etc/passwd for the
user (must be in /etc/shells allowed), e.g.

dummy:x:500:500:chroot user:/home/dummy:/bin/rshell

The passwd in /home/dummy/etc contains:

dummy:x:500:500::/:/bin/bash

Marcus

PGP Key: http://www.idnt.de/mzoller.txt
The finest in eTransactions http://www.idnt.de

Relevant Pages

  • Re: chroot and user home directories?
    ... >>Apache in a Chroot env ... I don't see the need for chroot, ... Setting 'rbash' as their shell will prevent a lot of things like that. ... into a user's home dir and the ftp daemon itself handles everything. ...
    (comp.os.linux.setup)
  • Re: chroot and user home directories?
    ... >>Apache in a Chroot env ... I don't see the need for chroot, ... Setting 'rbash' as their shell will prevent a lot of things like that. ... into a user's home dir and the ftp daemon itself handles everything. ...
    (comp.os.linux.misc)