RE: SFTP + Chroot

From: Timothy Carey (tcarey@bigfootinteractive.com)
Date: 10/31/01 

Subject: RE: SFTP + Chroot
Date: Wed, 31 Oct 2001 17:22:38 -0500
Message-ID: <1C1BC42B1A869348A06794D5CAED0BC307A4DB@exchange01.office.bigfootinteractive.com>
From: "Timothy Carey" <tcarey@bigfootinteractive.com>
To: <focus-linux@lists.securityfocus.com>

After doing a little more research, I answered my own question. For
those interested, here's how to do it:

1) Download and install ssh from ssh.com with the following option

./configure --enable-static

make ; make install.. blah blah

2)cd into the account you want to be chrooted and do the following:

> mkdir bin
> cd bin
> cp /usr/local/bin/ssh-dummy-shell.static .
> cp /usr/local/bin/sftp-server2.static .
> ln -s ssh-dummy-shell.static ssh-dummy-shell
> ln -s sftp-server2.static sftp-server

3) Configure sshd2_config by adding the following line:

                ChRootUsers user1,user2

                        -or-

                ChRootGroups group1,group2

4) Change the chrooted users shell to /bin/ssh-dummy-shell in
/etc/passwd (NO.. not /usr/local/bin/ssh-dummy-shell.. just use
/bin/ssh-dummy-shell)

Fire up sshd, and you should be all set..

-Tim

-----Original Message-----
From: Timothy Carey
Sent: Wednesday, October 31, 2001 03:39 PM
To: focus-linux@lists.securityfocus.com
Subject: SFTP + Chroot

Hi,

Is there a way to limit a users account to SFTP use without giving them
access to a login shell? Also, how would one keep a user chrooted in
their home directory once they access the machine via SFTP? Any thoughts
on this would be greatly appreciated. Thanks..

-Tim

tim@bigfootinteractive.com
UNIX Systems Administrator
www.bigfootinteractive.com

Relevant Pages

  • Re: Want unusual config...
    ... > SFTP in using sftp-server, and have their home directory appear to be the ... > there is no reason for them to need shell access to the server. ... You may need a chroot cage. ... chroot tools built into it, you can easily manage quite a secure little set ...
    (comp.security.ssh)
  • Can a users default file creation mode use a group theyre not a member of? (chroot/rssh issue)
    ... all users are in the chroot group; and their default umask is 066 - so user ... I have an "SFTP manager" who all the users are exchanging files with. ... WITHOUT having them IN the chadm group? ...
    (Debian-User)
  • Re: chroot SFTP ONLY
    ... chrooted while when he uses sftp, ... sftp session prior to the do_setusercontext function in session.c ... correctly the chroot system call can only be made as root and the ... Then make the compiled binary setuid root. ...
    (comp.security.ssh)
  • sftp with chroot
    ... chroot, so that users can be jailed to their home folder only. ... But sftp does not restrict to ... I tried to patch the Openssh 4.3p2 source code from openssh.org as given ... No output written to ssh ...
    (SunManagers)
  • Re: Chroot Environment crazy
    ... > All works fine and chroot environment(users only can connect with sftp in ... > their jail home) seems to be work fine, but from sftp client if i make a ... Which chroot patches or technique are you using? ... > My sftp client is the last filezilla on windows machine. ...
    (comp.security.ssh)