Re: chrooted ssh works, sftp doesn't
From: Richard E. Silverman (slade@shore.net)Date: 02/07/02
- Next message: Pontus Skold: "Re: File size limit exceeded"
- Previous message: Bruno Wolff III: "Re: "Don't panic"?"
- In reply to: piggy: "chrooted ssh works, sftp doesn't"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: slade@shore.net (Richard E. Silverman) Date: 07 Feb 2002 11:13:00 -0500
>>>>> "piggy" == piggy <piggy@lateral.net> writes:
piggy> Hi peeps I've got chrooted ssh working fine (using the chrsh
piggy> shell), but now the user can't sftp. There's no error
piggy> message. If I replace his shell with /usr/sbin/sftp-shell then
piggy> he can sftp but obviously not ssh.
Perhaps the sftp-server is not available (or runnable) in the chroot cage?
Remember that sshd runs all programs via the target account's shell.
piggy> Also, if he ssh to his account and then tries to ssh to the
piggy> localhost or the outside, he gets: Connecting to
piggy> foo.bar.com.... You don't exist, go away!
This is probably because you don't have have access to the passwd database
in the cage.
piggy> Is there a way to get both working in a chrooted environment?
Using chroot in this way for security is an inherently messy, unpleasant
idea. You have to replicate everything your programs need inside the cage
-- *every* cage, and there are often many -- which can quickly expand to
be so much that it defeats the original point of using chroot, or makes it
so complicated as to be a questionable tradeoff.
I understand that people get excited by the perceived absolute security
provided by the one-way chroot() call, but I think it's overused and
overrated.
Also note that since you're implementing this using chrsh, you're losing
much of that security anyway. Since sshd does not perform the chroot
itself, this does not protect against sshd exploits.
-- Richard Silverman slade@shore.net
- Next message: Pontus Skold: "Re: File size limit exceeded"
- Previous message: Bruno Wolff III: "Re: "Don't panic"?"
- In reply to: piggy: "chrooted ssh works, sftp doesn't"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
