restricting user access with ssh

rob_xx17 · 01-03-2006, 10:59 AM

Hey

I'm running SuSE 9.3 as a file server on the Internet. I want users to be able to securely login and deposit/retrieve files. But I don't want them to see other users' files. Also I don't want them to wander around the file system / I want the server to be secure. I know that I could 'jail' the home directory. But I'm having so much problems with it. SSH works fine but I created a new directory with 'bash' and all the required libraries and bash works fine but when I tried to put 'ssh' into that directory and it's not working. I got the following error message: "PRNG is not seeded".

Also, I'm not really sure if the 'passwd' and 'shadow' files are to be located inside the jail or can they be located outside of the jail. When I put them (with the appropriate entries only for the users that I want to access remotely) inside the jail, that user cannot login.

I tried to bind the user to different shells (rsh, rbash, false) but with no success. I also tried restricting user access by changing the properties of a directory (drwxr-xr-- 6 root root 144 2006-01-03 10:04 ..) but that failed as well.

Does anybody know of a simpler method of restricting a user to only a single directory? All I want the user to be able to do is to deposit and retrieve files. Thanks a million for your help.

r.

unSpawn · 01-03-2006, 11:28 AM

Google for Scponly or Rssh. Both provide (at least) scp/sftp functionality and can chroot a user.

rob_xx17 · 01-05-2006, 03:47 PM

thanks. I'm trying to get the 'rssh' working. But I'm having a tremendous problems with setting up the jail. I did everything that was suggested in the chroot manual for rssh but when I'm trying to connect to the account I get the 'connection closed' message. I know that I must have the jail not set up properfly because when I comment out the like setting up the chroot in the 'rssh.conf' file then I CAN log in. The problem is that, in such a case, the account is not jailed; it's not limited to the jail.

benjithegreat98 · 01-05-2006, 03:55 PM

There is something else you could look into, which is 'rbash' or 'bash -r'. You might want to google that and see if it something you are looking for.

unSpawn · 01-05-2006, 06:22 PM

If you installed rssh-2.3.0 look in the docdir for the CHROOT doc and read the first 20 lines about "Connection closed" and the need for the systems shell because of wordexp().