ssh jail issue

slowerogue · 01-02-2013, 05:52 AM

hi i want to make user login via ssh will be jailed to his directory..
newbie here, i find alot of tutorial about jail ssh, but all the result give me back the sftp result.
i hv did alot of configuration and makes me more confuse

Code:

groupadd sftponly
usermod sftponly user


#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp

Match Group sftponly
ChrootDirectory /aaa/home/%u
X11Forwarding no
AllowTCPForwarding no
ForceCommand internal-sftp

user from group sftponly will not be able to access to server via ssh/sftp.
Error: Software caused connection abort.
i have added/delete AllowGroups,
swap # between internal-sftp || /usr/lib/openssh/sftp-server
all still have the same error

or i have manually added

Code:

# mkdir /aaa
# cd /aaa
# mkdir {bin,dev,lib64}
# cp -p /bin/bash bin/
# cp -p /lib64/*.* lib/64
# mknod dev/null c 1 3
# mknod dev/zero c 1 5
# chmod 0666 dev/{null,zero}
# useradd -m -d /aaa/home/ch5 -s /aaa/bin/bash ch5

i can login ch5 via ssh, but not jailed
if i add user ch5 into group sftponly
it will have the same error as above
anyone pls help, or if i hv gone wrong too deep, just give me an exmaple of this .thanks

oh i have also use makejail.sh http://www.fuschlberger.net/programs...p-chroot-jail/
sh makejail.sh ch6 /bin/bash /export
still cannnot
please help ,ty

saagar · 01-02-2013, 11:23 AM

Hi,

Please find out if this could be of any help:

Code:

http://geek.co.il/wp/2010/03/14/how-to-build-a-chroot-jail-environment-for-centos

slowerogue · 01-02-2013, 09:39 PM

hi thanks for your reply. i have found why i was unable to connect using sftp
setenforce 0 will let me sftp to the rhel, with proper jail it in his directory.

but how do i jail ssh?

i want to jail a user from ssh and sftp(done), not root

thanks alot

btmiller · 01-02-2013, 10:24 PM

I suggest you look at the man page for sshd_conf, in particular the ChrootDirectory option. Note that this option should be placed after a "Match" line (so you can selectively choose which users and groups to chroot). For example, I have at the very end of my sshd_config:

Code:

Match group group1,group2
   ChrootDirectory /home/chroot