Tag Info

Hot answers tagged

30

All this pain is thanks to several security issues as detailed here. Basically the chroot directory has to be owned by root and can't be any group-write access. Lovely. So you essentially need to turn your chroot into a holding cell and within that you can have your editable content. sudo chown root /home/bob sudo chmod go-w /home/bob sudo mkdir ...


17

chroot is a way of entering a folder and 'faking' that folder being / to anything executed inside. This lets you run executables on a non-booting Ubuntu installation by mounting it somewhere other than / and using /bin/bash(the one inside the installation) to get a terminal prompt. sudo - Lets certain accounts authenticate to run a program as root or ...


12

To chroot an SFTP directory, you must 1) create an user and force root to be owner of it cd /home mkdir john useradd -d /home/john -M -N -g users john sudo chown root:root /home/john sudo chmod 755 /home/john 2) Change the subsystem location on /etc/ssh/sshd_config: #Subsystem sftp /usr/lib/openssh/sftp-server Subsystem sftp internal-sftp and create ...


12

Verify that you are using the right Live CD. For example, verify you are not using a 32bit CD instead of a 64bit CD. You need a 64bit kernel to run 64bit code, so check your architecture. Assuming you mounted your system to be chrooted in /media/sda1, to determine the architecture you can: ls /media/sda1/* if you see lib64 in the output, it's probably a ...


11

That article also describes how to get a chrooted shell access, but since you just want a sftp-only account, just follow these instructions: Edit /etc/ssh/sshd_config and add the lines: SubSystem sftp internal-sftp Match Group sftp ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no Find the line UsePam yes and comment it: ...


10

The important part to answer this question is this snippet from /etc/bash.bashrc: if [ -z "$debian_chroot" ] && [ -r /etc/debian_chroot ]; then debian_chroot=$(cat /etc/debian_chroot) fi It means if the variable $debian_chroot is empty and the file /etc/debian_chroot exists and is readable the variable is set to the content of the file. Now ...


7

Your Ubuntu seems to be using a LVM as its root. The ext2 partition you mounted contains the bare necessities to make your system able to boot and mount the lvm, the rest – including bash – is stored there. In order to find the LVM volume containing your data, you need the lvm2 package, which is not installed on a live system. Thus, install it. sudo ...


7

If the environemnt variable $debian_chroot exists and is not empty ${debian_chroot:+($debian_chroot)} is replaced by ($debian_chroot) (that is the value of $debian_chroot with parens around it). $debian_chroot is set in /etc/bash.bashrc to the contents of /etc/debian_chroot if that file exists (it doesn't by default) and $debian_chroot doesn't have a value ...


7

Jailkit is a set of utilities that can limit user accounts to a specific directory tree and to specific commands. Setting up a jail is much easier using the jailkit utilities that doing so 'by hand'. A jail is a directory tree that you create within your file system; the user cannot see any directories or files that are outside the jail directory. The user ...


6

Symlinks are locked into the jail the same way the user is; otherwise it would be possible for the user to break out of the jail with cd documents. (No, root-created symlinks can't be treated specially, for the same reason that cd -P symlink-to-dir; cd .. leaves you in the wrong place; the appearance of it working as you'd expect is an illusion created by ...


6

You can not confine them to /home as they need access to the system binaries and bash and configuration files in /etc IMO the easiest method of securing users is to use apparmor. You make a hard link ln /bin/bash /usr/local/bin/jailbash You add jailbash to /etc/shells You then assign jailbash to the users shell, and then write an apparmor profile for ...


5

I don't trust anything but the kernel to keep a sane state here, so I don't (ab)use init to get this job done, nor do I count on myself actually knowing what is or isn't mounted (some packages can mount extra filesystems, like binfmt_misc). So, for process slaughter, I use: PREFIX=/mnt/chroot-0 FOUND=0 for ROOT in /proc/*/root; do LINK=$(readlink ...


5

The persistant usb drive uses a compressed read-only filesystem (squashfs) and overlays a writable filesystem layer on top that stores changed files. The writable filesystem is stored in a single file (like a zip file, but without the compression - it is actually ext3, but that is unimportant) To put everything 'back together': Create the locations where ...


5

Generally, ${var:+value} means: if $var is defined; then use 'value'; else do nothing The debian_chroot variable is defined in /etc/bash.bashrc file. It takes the content of /etc/debian_chroot file if this file exists and is readable. By default this file doesn't exists. For more details, see: What is $debian_chroot in .bashrc? Understand this .bashrc ...


4

In order to chroot to do things like.. configure/install grub, do the following- #first, mount new install to /mnt/oneiric mount -t proc proc /mnt/oneiric/proc mount -t sysfs sys /mnt/oneiric/sys mount -o bind /dev /mnt/oneiric/dev chroot /mnt/oneiric /bin/bash I wouldn't try to start full gnome this way. The only reason you should really be doing this ...


4

I'm using Ubuntu LTS 12.04 and after a lot of pain, this worked for me. My Settings for /etc/ssh/sshd_config Subsystem sftp internal-sftp -f AUTH -l VERBOSE UsePAM yes Match group sftp ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no create group sftp: groupadd sftp Create user directly with new sftp group attached: sudo ...


4

It's pretty easy to add your own variant with additional custom packages to debootstrap. The debootstrap configuration/runtime scripts are located in /usr/share/debootstrap/scripts. Let's create an allmybase variant which includes everything in minbase along with the packages htop and traceroute. Open /usr/share/debootstrap/scripts/precise in your ...


3

Many developers use pbuilder for this task. There is a very comprehensive guide to pbuilder on the Ubuntu wiki. You might also look into the pbuilder-dist script. It is a is a wrapper that makes it easy to use pbuilder with many different versions of Ubuntu and/or Debian. It is available in the ubuntu-dev-tools package.


2

Well I finally found out that I copied the required libraries on wrong folder, because when I tested chroot for first time I was on a 32bit Ubuntu Machine, while my server is 64bit. So, I copied the required libraries and bin/sh at the proper folders at my directory that I would like to jail and it worked just fine. :D Thanks you all!


2

You can boot a sub directory by replacing your sbin init with a script which uses pivot_root, the process is sketchy and various people have reported failure as much as sucesses. So try it and see, but keep a live cd handy in case your system becomes unbootable. Details here: http://linux.die.net/man/8/pivot_root What we could do with, is an automatic ...


2

There is a typo on your instructions, on /etc/schroot/chroot.d/hardy-i386 you are using /srv/chroot/hardy-i386 , while for the mkdir/debootstrap you are using hardy_i386 for the directory. That explains the error. I have just fixed the path at /etc/schroot/chroot.d/hardy-i386, tested, it worked as expected.


2

The package schroot supports LVM and Btrfs snapshots. From its man page: Source chroots Some chroot types, for example LVM snapshots and Btrfs snapshots, provide session-managed copy-on-write snapshots of the chroot. These also provide a source chroot to allow easy access to the filesystem used as a source for snapshotting. These are regular ...


2

The package pbuilder is exactly what you need. It will allow you to construct a chroot environment, build and install your package. Even a pbuilder-cross variety exists. It is a set of command line tools, so no virtual machine point and click required. After a steep but short learning curve, you can probably automate building different architectures and ...


2

chrrot has nothing to do with dual booting. The idea behind chroot is an ability to switch one program, or one shell, etc., to a new root directory, allowing you to have multiple "systems" at the same time. "systems" is in quotes because there is still only one Linux kernel running. This other "system" is an additional set of the code tools, home ...


2

Let me try to explain chroot in terms of Windows. In windows the "root" of the boot partition is called "C:\" In Linux it is called "/". choort (temporarily) allows you to make some other folder/partition/device the root partition. If Windows had a choot command it might have worked as follows. Imagine you have a computer with two partitions or drives with ...


2

There are a couple of techniques, the simplest is to use a chrooted environment. In this environment you can then run sudo aptitude update and most other command line tools. Alternatively you could create a number of virtual box virtual machines that used the partitions as their hard drives - I have not tried this. For the chroot environment mount each ...


2

You can't really run upstart itself in a chroot. For it to work, you'd need something like an LXC container. Unfortunately most Android kernels don't have the required options to allow LXC to work. Without LXC, the way of getting a chroot on your phone is to run: sudo debootstrap --foreign --arch=armhf precise precise then copy precise/ to your phone then ...


2

A chroot may be used directly as root by running chroot(8), but normal users are not able to use this command. schroot allows access to chroots for normal users using the same mechanism, but with permissions checking and allowing additional automated setup of the chroot environment, such as mounting additional filesystems and other configuration tasks. This ...


2

If you're not short of a bit of space, you could use debootstrap to install a minimal complete OS in your chroot. This then makes apt available in your chroot. To start with: sudo apt-get install debootstrap To setup a new chroot: sudo debootstrap oneiric /path/to/chroot sudo chroot /path/to/chroot /bin/bash Voila, you're in a new minimal Ubuntu ...



Only top voted, non community-wiki answers of a minimum length are eligible