SFTP jail Users Password updation

kjsubbu · 03-23-2011, 12:33 AM

Hi to all,
I have configured the SFTP Jail for some of the users in my sftp server and which is hosted for my clients.
i have one small issues and i need the help from experts.
when i am resting the password it's updating in /etc/shadow file not in the /../jajil/etc/shadow file.
can you please help me how to update the password in /../jail/etc/shadow file instead of updating in /etc/shadow file.

anomie · 03-23-2011, 04:11 PM

A few ideas come to mind, in order of attractiveness (to me):

If your distro / version allows it, you could utilize the baked-in sftp server (+Match +ChrootDirectory) available in OpenSSH. Then, when you make sftp user password updates, they'll take system-wide.
You could create a "change password" script that accepts/audits a user account argument, and then 1) runs it through passwd(1); 2) carefully backs up the jailed shadow(5) file, then copies the shadow(5) file from host to jail, preserving permissions.
You could put the passwd(1) program and its libraries within the jail as well, and always change passwords in two places. (Ugh.)

kjsubbu · 03-24-2011, 12:20 AM

Thanks anomie for your reply,
ya i did the same only, i wrote the small script to place the password and account expire details in to /../jail/etc/shadow file.
unfortantely the script is copying the other or unwanted user details also, like root user details also in /../jail/etc/shadow file.
Now i have another question...
/../jail/etc/shadow file having root users details will create any issue...

anomie · 03-24-2011, 04:05 PM

Just curious - what sort of jail kit is this? And are you sure you can't use the OpenSSH approach I mentioned above?

As for copying shadow(5) entries, here's one way to grab only the lines you want:

Code:

# egrep '^user1:|^user2:|^user3:' /etc/passwd > /path/to/jail/etc/passwd
# egrep '^user1:|^user2:|^user3:' /etc/shadow > /path/to/jail/etc/shadow

(Be careful with that. Test it before using it on a production system.)