Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I need a simple and easy way to jail users in their home directories in Oneiric. Do you have a simple configuration for jailing users, with full help, or some good web links?

I would be offering an online free public server with 10 to 20 GB free space. I don't know how many users. I want to give them SSH and SFTP so that they can connect through FileZilla.

share|improve this question
    
2nd update if users are not locked in home directories –  One Zero Jan 10 '12 at 17:33
    
How many users would you have? a handfull or thousands? –  Ali Jan 10 '12 at 18:01
    
i would be offering online free public server 10 to 20 GB FREE space .... dont know how many users –  One Zero Jan 10 '12 at 18:04
    
then I believe you 1-as mentioned by @Marco you want to try ChrootDirectory for SSH 2- you may want to go beyond the standard ways of doing things as you need to scale this to handle "a lot" of storage, ... 3- Is SSH your best choice? do people need SSH on your service? 4- Good luck –  Ali Jan 10 '12 at 18:10
1  
i have other plan as well .... for normal users we would be offering only SFTP with MY SECURE SHELL , that's very easy 2 handle –  One Zero Jan 10 '12 at 18:23
show 1 more comment

4 Answers 4

up vote 9 down vote accepted

Jailkit is a set of utilities that can limit user accounts to a specific directory tree and to specific commands. Setting up a jail is much easier using the jailkit utilities that doing so 'by hand'. A jail is a directory tree that you create within your file system; the user cannot see any directories or files that are outside the jail directory. The user is jailed in that directory and it subdirectories.

Download & Install

http://olivier.sessink.nl/jailkit/index.html#download

# cd /tmp
# wget http://olivier.sessink.nl/jailkit/jailkit-2.14.tar.gz
# tar -zxvf jailkit-2.11.tar.gz
# cd jailkit-2.11
# ./configure
# make
# make install

Setting up the jail

Now it’s time to set up the jail directory. Jailed users will see this directory as the root directory of the server. I chose to use /home/jail:

# mkdir /home/jail
# chown root:root /home/jail

jk_init can be used to quickly create a jail with several files or directories needed for a specific task or profile , (click on it & read full detail ).

# jk_init -v /home/jail basicshell
# jk_init -v /home/jail netutils
# jk_init -v /home/jail ssh
# jk_init -v /home/jail jk_lsh

Add a user

Add a new user with a home directory and bash shell, and set the password:

# useradd -d /home/testuser -m testuser -s /bin/bash
# passwd testuser

Now it’s time to jail this user, use the following command:

# jk_jailuser -m -j /home/jail testuser

Your /etc/passwd should contain something like this now:

testuser:x:1001:1001::/home/jail/./home/testuser:/usr/sbin/jk_chrootsh

Enable bash

By using jk_cp the bash libraries are be copied to the jail:

# jk_cp -v -f /home/jail /bin/bash

Now edit the /home/jail/etc/passwd file and make sure it contains something like this:

testuser:x:1001:1001::/home/testuser:/bin/bash

Maintenance

By using jk_update updates on the real system can be updated in the jail. A dry-run will >show what’s going on:

# jk_update -j /home/jail -d

Without the -d argument the real update is performed. More maintenance operations can be found here.

Help Taken

http://olivier.sessink.nl/jailkit/howtos_chroot_shell.html

http://olivier.sessink.nl/jailkit/index.html#intro ( a very good help )

This one also

This is been checked & verified , Working Properly

share|improve this answer
    
+1 very good. highly recommend reading the links you mentioned above in the "Help Taken" section too –  cwd May 24 '13 at 22:41
    
This doesn't work on Ubuntu 13.10. When you try to finally login you get the welcome message immediately followed by connection closed. –  Matt H Feb 9 at 23:52
    
Matt H: Make sure to follow the last two steps; copying the bash binaries and editing the /home/jail/etc/passwd file. –  ONOZ May 20 at 10:10
add comment

You can not confine them to /home as they need access to the system binaries and bash and configuration files in /etc

IMO the easiest method of securing users is to use apparmor.

You make a hard link

ln /bin/bash /usr/local/bin/jailbash

You add jailbash to /etc/shells

You then assign jailbash to the users shell, and then write an apparmor profile for jailbash allowing minimal access.

sudo chsh -s /usr/local/bin/jailbash user_to_confine

You will have to write an apparmor profile yourself, but I have a profile you could potentially start with

http://bodhizazen.net/aa-profiles/bodhizazen/ubuntu-10.04/usr.local.bin.jailbash

share|improve this answer
    
You can not confine them to /home as they need access to the system binaries and bash and configuration files in /etc There is nothing stopping you from linking/copying files you feel they need. –  user606723 Jan 6 '12 at 21:52
1  
Yes you "can" do as user606723 suggests, but it is not so easy, and IMO of all the potential solutions the least practical or easy. Might as well build a chroot or use lxc. You copy a binary, then the libs. Often you will manually need to identify libs with ldd. This method takes a ton of work to set up. And then you have to keep the jail up to date, you will have to manually update (copy) the binaries / libs. Links might work better in terms of updates, but you still need to set them all up. Somehow I do not think this is what the OP had in mind. How then to keep them confined ? –  bodhi.zazen Jan 6 '12 at 22:08
1  
I think the whole point of the question was to point out tools to automate this process... like jailkit, a tool the OP mentions. –  user606723 Jan 6 '12 at 22:28
    
@bodhi.zazen . what u think about about this .. debootstrap (oneiric) then make a container using lxc . using jail kit > user to container > . what i did so far is i have debbootstrap oneiric minimum then used jailkit >working fine –  One Zero Jan 7 '12 at 14:44
    
you can use LXC for this task, beware that isolation is sometimes incomplete with LXC. As long as users do not have root access in the container you should be OK and you may want to subscribe to the LXC mailing list. –  bodhi.zazen Jan 7 '12 at 15:06
show 6 more comments

You could check out rbash as a shell for your users.

man bash

Search for RESTRICTED SHELL section

Or look on this page http://linux.die.net/man/1/bash

share|improve this answer
1  
Just be very careful with rbash, it is very easy to break out of and sort of considered outdated. See blog.bodhizazen.net/linux/how-to-restrict-access-with-rbash –  bodhi.zazen Jan 6 '12 at 21:43
    
@bodhi.zazen You mean rbash? –  Karlson Jan 6 '12 at 21:47
    
yes, sorry I fixed that. There was a blog several years ago where someone broke our of a rbash jail I set up, and I though it was tight, minimal jail. Took them less then 5 minutes. Not had anyone break out of jailbash. –  bodhi.zazen Jan 6 '12 at 21:49
    
can u plz tell me how do i configure it ....jailbash –  One Zero Jan 7 '12 at 13:24
    
yes, man bash helps, using bash restrited shell capabilities is more simply –  c4f4t0r Feb 26 at 11:21
add comment

It's difficult to guess what purpose you might want to accomplish. If it is to deny ssh/sftp while providing jailed access via FTP... easy:

Add to /etc/shells a new shell:

sudo -e /etc/shells

Add one line:

/bin/false

Save. For each user you want to deny ssh/sftp, change the user's shell:

sudo chsh -s /bin/false userx

Now userx cannot log in via ssh/sftp.

Install vsftpd:

sudo apt-get install vsftpd

Edit the config file:

sudo -e /etc/vsftpd.conf

And some changes....

anonymous_enable=NO
local_enable=YES
chroot_local_user=YES

Save. Restart vsftpd:

sudo /etc/init.d/vsftpd restart
share|improve this answer
    
well i m want to give them ssh + sftp (connect through filezilla) –  One Zero Jan 7 '12 at 5:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.