Re: Lock user into one directory?

From: Nico Kadel-Garcia (nkadel@verizon.net)
Date: 04/22/03 

From: Nico Kadel-Garcia <nkadel@verizon.net>
Date: Tue, 22 Apr 2003 11:56:45 GMT

Sebastian Schack wrote:
> On 04/22/03 00:00 Armin Krawinkel wrote:
>
>
>>i think chroot is what you are searching for
>>
>
>
> Hm... but if I "chroot" a user into his homedirectory, can he still gain
> access to other directories if he connects via FTP?
>
> Sebastian

Nope. That's the whole point of a good chroot cage. The "chroot"
directory is now effectively the "/" directory, moo-ha-ha-ha, now
your're trapped, my pretty!

FTP can be configured to act this way as well: Take a look at the
"anonftp" software bundles for RedHat and other Linux systems, which
provide an appropriate chroot cage for FTP use. Setting it up for SSH is
a bit more of an adventure, since the OpenSSH authors have never
integrated in any of the various published chroot patches.

I really wish they would, it's a useful tool.

Relevant Pages

  • Re: FTP guest access chroot not working
    ... the "root" dir for the chroot is /home/someguy/ftp ... # chroot ftp users ... cannot get out of that jail. ... if you created a symlink inside the jail that points to some real ...
    (comp.unix.sco.misc)
  • Re: Q: Impact of globbing vulnerability in ftpd
    ... so ftpd is already chrooted and running with the uid of the user at ... sufficient to allow the vulnerability to be exploited. ... compounded because the FTP server only runs with an effective UID of the ... there are processes outside of the chroot() running as the same user. ...
    (FreeBSD-Security)
  • ftp & PAM chroot jail dir experts
    ... hope you ftp chroot dir experts can help me with this one, ... Jan 29 17:57:42 www kernel: Packet log: input ACCEPT lo PROTO=6 ... upload /var/ftp/* /etc no ...
    (comp.os.linux.security)
  • Re: ftpchroot doesnt work
    ... Which FTP daemon are you using? ... used as a "chroot to this directory" marker. ... and various system files like /etc/passwd available in ...
    (comp.os.linux.misc)
  • Re: To chroot or not to chroot?
    ... > webserver, which should have an http server, webmail, php support, ... > dns, ftp, remote login and a couple more things. ... My understanding of chroot, is that if the service is compromised, then the ... As for login, use sshd and only allow key-based authentication. ...
    (Security-Basics)