Re: chroot SFTP ONLY


Steven Mocking wrote:
If I recall
correctly the chroot system call can only be made as root and the
sftp-server is run as a subsystem request by a user inside the ssh
session. That's why it's FTP *over* SSH. Before that, there is not
really something specific which tells you if a session is sftp or shell.

Perhaps you could patch/modify the sftp-server sourcecode to do
something like

uid_t uid = getuid(); chroot("/path/to/chroot"); seteuid(uid);

very early on in the code. Then make the compiled binary setuid root. Be
careful though, because there is always the danger of holes with setuid
root binaries, like users setting LD_LIBRARY_PATH and LD_PRELOAD.

I wanted to patch the session.c only to make it easier to port (on
hundreds of hybrid UNIX systems) but after reading most of the SSH code
with no clues, I guess your right the only way to go would be to patch
the sftp-server.c as well.

The best way to go is to seperate sftp users from login ones and chroot
normally (both) as required. but it's worth investigating ;)

Thanks anyway Steve,
MJ

.

Relevant Pages

  • RE: Linux hacked
    ... Also, what exactly did the history file show, can you paste it into a mail ... > First let me say I'm a security novice. ... > been unsuccessful in getting root back. ... > via ssh but you could su in once logged in as one of three users. ...
    (Security-Basics)
  • Re: Linux hacked
    ... To find out what kernel version you are running, type "uname -a" without ... > been unsuccessful in getting root back. ... > via ssh but you could su in once logged in as one of three users. ...
    (Security-Basics)
  • Re: X11Forwarding, ssh -X, and /bin/su
    ... ]>but I'm not really tunneled using ssh then, ... ]connecting to the X server and have the home directory NFS-mounted ... ](unless you leave root unmapped over NFS, ... ]root-readable place and set the environment $XAUTHORITY variable ...
    (comp.security.ssh)
  • RE: Linux hacked
    ... hack the box, pull the drive and save it. ... Use the newest versions of Gentoo, Apache, SSH, PHP and Squirl Mail. ... been unsuccessful in getting root back. ... I found a hidden directory /var/tmp/.tmp that has a bunch of directories ...
    (Security-Basics)
  • RE: Linux hacked
    ... Was any of the sites running a php nuke or another portal or system that is vuln ... been able to use that with a locla root exploit to gain root on the machine. ... > hack the box, pull the drive and save it. ... > Use the newest versions of Gentoo, Apache, SSH, PHP and Squirl Mail. ...
    (Security-Basics)