Tag Info

Hot answers tagged

37

All this pain is thanks to several security issues as detailed here. Basically the chroot directory has to be owned by root and can't be any group-write access. Lovely. So you essentially need to turn your chroot into a holding cell and within that you can have your editable content. sudo chown root /home/bob sudo chmod go-w /home/bob sudo mkdir ...


17

chroot is a way of entering a folder and 'faking' that folder being / to anything executed inside. This lets you run executables on a non-booting Ubuntu installation by mounting it somewhere other than / and using /bin/bash(the one inside the installation) to get a terminal prompt. sudo - Lets certain accounts authenticate to run a program as root or ...


17

To chroot an SFTP directory, you must 1) create an user and force root to be owner of it cd /home mkdir john useradd -d /home/john -M -N -g users john sudo chown root:root /home/john sudo chmod 755 /home/john 2) Change the subsystem location on /etc/ssh/sshd_config: #Subsystem sftp /usr/lib/openssh/sftp-server Subsystem sftp internal-sftp and create ...


15

Verify that you are using the right Live CD. For example, verify you are not using a 32bit CD instead of a 64bit CD. You need a 64bit kernel to run 64bit code, so check your architecture. Assuming you mounted your system to be chrooted in /media/sda1, to determine the architecture you can: ls /media/sda1/* if you see lib64 in the output, it's probably a ...


15

The important part to answer this question is this snippet from /etc/bash.bashrc: if [ -z "$debian_chroot" ] && [ -r /etc/debian_chroot ]; then debian_chroot=$(cat /etc/debian_chroot) fi It means if the variable $debian_chroot is empty and the file /etc/debian_chroot exists and is readable the variable is set to the content of the file. Now ...


14

That article also describes how to get a chrooted shell access, but since you just want a sftp-only account, just follow these instructions: Edit /etc/ssh/sshd_config and add the lines: SubSystem sftp internal-sftp Match Group sftp ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no Find the line UsePam yes and comment it: ...


9

Jailkit is a set of utilities that can limit user accounts to a specific directory tree and to specific commands. Setting up a jail is much easier using the jailkit utilities that doing so 'by hand'. A jail is a directory tree that you create within your file system; the user cannot see any directories or files that are outside the jail directory. The user ...


8

If the environemnt variable $debian_chroot exists and is not empty ${debian_chroot:+($debian_chroot)} is replaced by ($debian_chroot) (that is the value of $debian_chroot with parens around it). $debian_chroot is set in /etc/bash.bashrc to the contents of /etc/debian_chroot if that file exists (it doesn't by default) and $debian_chroot doesn't have a value ...


7

Symlinks are locked into the jail the same way the user is; otherwise it would be possible for the user to break out of the jail with cd documents. (No, root-created symlinks can't be treated specially, for the same reason that cd -P symlink-to-dir; cd .. leaves you in the wrong place; the appearance of it working as you'd expect is an illusion created by ...


7

Your Ubuntu seems to be using a LVM as its root. The ext2 partition you mounted contains the bare necessities to make your system able to boot and mount the lvm, the rest – including bash – is stored there. In order to find the LVM volume containing your data, you need the lvm2 package, which is not installed on a live system. Thus, install it. sudo ...


6

You can not confine them to /home as they need access to the system binaries and bash and configuration files in /etc IMO the easiest method of securing users is to use apparmor. You make a hard link ln /bin/bash /usr/local/bin/jailbash You add jailbash to /etc/shells You then assign jailbash to the users shell, and then write an apparmor profile for ...


6

This chapter will show you how to convert your Linux box into an FTP server using the default Very Secure FTP Daemon (VSFTPD)


6

In my opinion the question is more about not understanding what chroot does. It moves the / to wherever you tell it, so there's no more /bin, /sbin, or /usr. This means you're not going to have sudo anymore since it lives in one of those directories.


6

Generally, ${var:+value} means: if $var is defined; then use 'value'; else do nothing The debian_chroot variable is defined in /etc/bash.bashrc file. It takes the content of /etc/debian_chroot file if this file exists and is readable. By default this file doesn't exists. For more details, see: What is $debian_chroot in .bashrc? Understand this .bashrc ...


6

I don't trust anything but the kernel to keep a sane state here, so I don't (ab)use init to get this job done, nor do I count on myself actually knowing what is or isn't mounted (some packages can mount extra filesystems, like binfmt_misc). So, for process slaughter, I use: PREFIX=/mnt/chroot-0 FOUND=0 for ROOT in /proc/*/root; do LINK=$(readlink ...


5

The persistant usb drive uses a compressed read-only filesystem (squashfs) and overlays a writable filesystem layer on top that stores changed files. The writable filesystem is stored in a single file (like a zip file, but without the compression - it is actually ext3, but that is unimportant) To put everything 'back together': Create the locations where ...


5

See the schroot package. Man Page As an alternative, you can shorthand the bind mounting with: for f in proc sys dev ; do mount --bind /$f /mnt/$f ; done


5

I'm using Ubuntu LTS 12.04 and after a lot of pain, this worked for me. My Settings for /etc/ssh/sshd_config Subsystem sftp internal-sftp -f AUTH -l VERBOSE UsePAM yes Match group sftp ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no create group sftp: groupadd sftp Create user directly with new sftp group attached: sudo ...


5

Oh well, I figured it out myself. schroot has a features called "sessions" that allows preservation of current system environment. I somehow thought that adding new users would not be a part of "environment".


4

In order to chroot to do things like.. configure/install grub, do the following- #first, mount new install to /mnt/oneiric mount -t proc proc /mnt/oneiric/proc mount -t sysfs sys /mnt/oneiric/sys mount -o bind /dev /mnt/oneiric/dev chroot /mnt/oneiric /bin/bash I wouldn't try to start full gnome this way. The only reason you should really be doing this ...


4

It's pretty easy to add your own variant with additional custom packages to debootstrap. The debootstrap configuration/runtime scripts are located in /usr/share/debootstrap/scripts. Let's create an allmybase variant which includes everything in minbase along with the packages htop and traceroute. Open /usr/share/debootstrap/scripts/precise in your ...


4

A chroot may be used directly as root by running chroot(8), but normal users are not able to use this command. schroot allows access to chroots for normal users using the same mechanism, but with permissions checking and allowing additional automated setup of the chroot environment, such as mounting additional filesystems and other configuration tasks. This ...


3

SU connects you as root. The terminal will remain as root for the session. With sudo (superuser do) you can perform operations as root while connected as a regular user.


3

Many developers use pbuilder for this task. There is a very comprehensive guide to pbuilder on the Ubuntu wiki. You might also look into the pbuilder-dist script. It is a is a wrapper that makes it easy to use pbuilder with many different versions of Ubuntu and/or Debian. It is available in the ubuntu-dev-tools package.


3

you may try linux32 ./setup this helps for 32Bit teamspeak on 64bit servers. from man: (linux32 is an setarch alias) setarch - change reported architecture in new program environment and set personality flags


2

There is a typo on your instructions, on /etc/schroot/chroot.d/hardy-i386 you are using /srv/chroot/hardy-i386 , while for the mkdir/debootstrap you are using hardy_i386 for the directory. That explains the error. I have just fixed the path at /etc/schroot/chroot.d/hardy-i386, tested, it worked as expected.


2

Well I finally found out that I copied the required libraries on wrong folder, because when I tested chroot for first time I was on a 32bit Ubuntu Machine, while my server is 64bit. So, I copied the required libraries and bin/sh at the proper folders at my directory that I would like to jail and it worked just fine. :D Thanks you all!


2

I think you have to make the DefaultRoot path more loose, I'm afraid proftpd cannot handle symlinks outside this chroot jail. So basically you can symlink, but only inside the DefaultRoot folder.


2

In case someone is still searching for an answer, from the documentation of Proftpd : Filesystem Tricks A typical scenario is one where "DefaultRoot ~" is used to restrict users to their home directories, and where the administrator would like to have a shared upload directory, say /var/ftp/incoming, in each user's home directory. Symbolic links ...



Only top voted, non community-wiki answers of a minimum length are eligible