I would like to allow someone to access my server via ssh and directly access the MySQL command line, but limit other access. Using jailkit on Centos7, it mostly works, but I have a few questions. Below are the steps I have taken (maybe a couple were done in slightly different order):
1a. Compile the software
2a. The jailkit configuration file is set up for some applications, but not MariaDB, so I used
rpm -ql MariaDB-client to identify the the required paths to be added to
/etc/jailkit/jk_init.ini.
Do I really need to add all those paths?
Code:
cat <<EOF | sudo tee /etc/jailkit/jk_init.ini
[mariadb]
comment = MariaDB-client bla bla bla
paths = /etc/my.cnf.d,/etc/my.cnf.d/mysql-clients.cnf,/usr/bin/msql2mysql,/usr/bin/mysql,/usr/bin/mysql_embedded,/usr/bin/mysql_find_rows,/usr/bin/mysql_plugin,/usr/bin/mysql_waitpid,/usr/bin/mysqlaccess,/usr/bin/mysqladmin,/usr/bin/mysqlbinlog,/usr/bin/mysqlcheck,/usr/bin/mysqldump,/usr/bin/mysqlimport,/usr/bin/mysqlshow,/usr/bin/mysqlslap,/usr/share/man/man1/msql2mysql.1.gz,/usr/share/man/man1/mysql.1.gz,/usr/share/man/man1/mysql_find_rows.1.gz,/usr/share/man/man1/mysql_plugin.1.gz,/usr/share/man/man1/mysql_waitpid.1.gz,/usr/share/man/man1/mysqlaccess.1.gz,/usr/share/man/man1/mysqladmin.1.gz,/usr/share/man/man1/mysqlbinlog.1.gz,/usr/share/man/man1/mysqlcheck.1.gz,/usr/share/man/man1/mysqldump.1.gz,/usr/share/man/man1/mysqlimport.1.gz,/usr/share/man/man1/mysqlshow.1.gz,/usr/share/man/man1/mysqlslap.1.gz
EOF
2b. Allow programs to run in jail. Is the use of hard links (-k) a good idea? Originally, I didn't include jk_lsh below and received errors and adding jk_lsh "fixed it", but I don't know why. Why is jk_lsh used?
Code:
sudo jk_init -v -k -j /home/jail basicshell editors extendedshell netutils ssh sftp scp jk_lsh mariadb
2c. Allow all users to have access to tmp as described by
https://olivier.sessink.nl/jailkit/h...oot_shell.html. Doesn't seem that jailed user has access to tmp. Why?
Code:
sudo mkdir /home/jail/tmp
sudo chmod a+rwx /home/jail/tmp
2d. Copy files including permissions and libraries into a jail. What is this doing?
Code:
jk_cp -v -f /home/jail /bin/bash
3a. Create user and add to jail
Code:
sudo useradd testuser
sudo passwd testuser
sudo jk_jailuser -m -j /home/jail testuser
3b. Edit /home/jail/etc/passwd
Code:
root:x:0:0:root:/root:/bin/bash
#testuser:x:1003:1003::/home/testuser:/usr/sbin/jk_lsh
testuser:x:1003:1003::/home/testuser:/bin/bash
So, now I log ssh as the jailed user, but get the following:
Code:
bash: /usr/bin/id: No such file or directory
In testuser's root directory, .bashrc includes:
Code:
if [ -f /etc/bashrc ]; then
. /etc/bashrc
fi
Then in /
home/jail/etc/bashrc:
Code:
# By default, we want umask to get set. This sets it for non-login shell.
# Current threshold for system reserved uid/gids is 200
# You could check uidgid reservation validity in
# /usr/share/doc/setup-*/uidgid file
if [ $UID -gt 199 ] && [ "`/usr/bin/id -gn`" = "`/usr/bin/id -un`" ]; then
umask 002
else
umask 022
fi
Looks like this is the issue, but now sure how to deal with it.
Also, I also tried the following, but get the following errors. What is causing them.
Code:
jk_update -j /home/jail -d
ERROR: while scannign dir /home/jail/lib/: No such file or directory
ERROR: while scannign dir /home/jail/opt/: No such file or directory
Lastly, can I just delete the users and /home/jail, and then start over?
