Tag Info

Hot answers tagged

49

All this pain is thanks to several security issues as detailed here. Basically the chroot directory has to be owned by root and can't be any group-write access. Lovely. So you essentially need to turn your chroot into a holding cell and within that you can have your editable content. sudo chown root /home/bob sudo chmod go-w /home/bob sudo mkdir ...


28

To chroot an SFTP directory, you must 1) create an user and force root to be owner of it cd /home mkdir john useradd -d /home/john -M -N -g users john sudo chown root:root /home/john sudo chmod 755 /home/john 2) Change the subsystem location on /etc/ssh/sshd_config: #Subsystem sftp /usr/lib/openssh/sftp-server Subsystem sftp internal-sftp and create ...


23

The important part to answer this question is this snippet from /etc/bash.bashrc: if [ -z "$debian_chroot" ] && [ -r /etc/debian_chroot ]; then debian_chroot=$(cat /etc/debian_chroot) fi It means if the variable $debian_chroot is empty and the file /etc/debian_chroot exists and is readable the variable is set to the content of the file. Now ...


19

chroot is a way of entering a folder and 'faking' that folder being / to anything executed inside. This lets you run executables on a non-booting Ubuntu installation by mounting it somewhere other than / and using /bin/bash(the one inside the installation) to get a terminal prompt. sudo - Lets certain accounts authenticate to run a program as root or ...


17

Verify that you are using the right Live CD. For example, verify you are not using a 32bit CD instead of a 64bit CD. You need a 64bit kernel to run 64bit code, so check your architecture. Assuming you mounted your system to be chrooted in /media/sda1, to determine the architecture you can: ls /media/sda1/* if you see lib64 in the output, it's probably a ...


15

That article also describes how to get a chrooted shell access, but since you just want a sftp-only account, just follow these instructions: Edit /etc/ssh/sshd_config and add the lines: SubSystem sftp internal-sftp Match Group sftp ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no Find the line UsePam yes and comment it: ...


13

Jailkit is a set of utilities that can limit user accounts to a specific directory tree and to specific commands. Setting up a jail is much easier using the Jailkit utilities that doing so 'by hand'. A jail is a directory tree that you create within your file system; the user cannot see any directories or files that are outside the jail directory. The user ...


12

Generally, ${var:+value} means: if $var is defined; then use 'value'; else do nothing The debian_chroot variable is defined in /etc/bash.bashrc file. It takes the content of /etc/debian_chroot file if this file exists and is readable. By default this file doesn't exists. For more details, see: What is $debian_chroot in .bashrc? Understand this .bashrc ...


10

If the environemnt variable $debian_chroot exists and is not empty ${debian_chroot:+($debian_chroot)} is replaced by ($debian_chroot) (that is the value of $debian_chroot with parens around it). $debian_chroot is set in /etc/bash.bashrc to the contents of /etc/debian_chroot if that file exists (it doesn't by default) and $debian_chroot doesn't have a value ...


8

Symlinks are locked into the jail the same way the user is; otherwise it would be possible for the user to break out of the jail with cd documents. (No, root-created symlinks can't be treated specially, for the same reason that cd -P symlink-to-dir; cd .. leaves you in the wrong place; the appearance of it working as you'd expect is an illusion created by ...


8

I don't trust anything but the kernel to keep a sane state here, so I don't (ab)use init to get this job done, nor do I count on myself actually knowing what is or isn't mounted (some packages can mount extra filesystems, like binfmt_misc). So, for process slaughter, I use: PREFIX=/mnt/chroot-0 FOUND=0 for ROOT in /proc/*/root; do LINK=$(readlink ...


7

I'm using Ubuntu LTS 12.04 and after a lot of pain, this worked for me. My Settings for /etc/ssh/sshd_config Subsystem sftp internal-sftp -f AUTH -l VERBOSE UsePAM yes Match group sftp ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no create group sftp: groupadd sftp Create user directly with new sftp group attached: sudo ...


7

Your Ubuntu seems to be using a LVM as its root. The ext2 partition you mounted contains the bare necessities to make your system able to boot and mount the lvm, the rest – including bash – is stored there. In order to find the LVM volume containing your data, you need the lvm2 package, which is not installed on a live system. Thus, install it. sudo ...


6

Oh well, I figured it out myself. schroot has a features called "sessions" that allows preservation of current system environment. I somehow thought that adding new users would not be a part of "environment".


6

This chapter will show you how to convert your Linux box into an FTP server using the default Very Secure FTP Daemon (VSFTPD)


6

In my opinion the question is more about not understanding what chroot does. It moves the / to wherever you tell it, so there's no more /bin, /sbin, or /usr. This means you're not going to have sudo anymore since it lives in one of those directories.


6

You can not confine them to /home as they need access to the system binaries and bash and configuration files in /etc IMO the easiest method of securing users is to use apparmor. You make a hard link ln /bin/bash /usr/local/bin/jailbash You add jailbash to /etc/shells You then assign jailbash to the users shell, and then write an apparmor profile for ...


6

A chroot may be used directly as root by running chroot(8), but normal users are not able to use this command. schroot allows access to chroots for normal users using the same mechanism, but with permissions checking and allowing additional automated setup of the chroot environment, such as mounting additional filesystems and other configuration tasks. This ...


6

It's pretty easy to add your own variant with additional custom packages to debootstrap. The debootstrap configuration/runtime scripts are located in /usr/share/debootstrap/scripts. Let's create an allmybase variant which includes everything in minbase along with the packages htop and traceroute. Open /usr/share/debootstrap/scripts/precise in your ...


5

The persistant usb drive uses a compressed read-only filesystem (squashfs) and overlays a writable filesystem layer on top that stores changed files. The writable filesystem is stored in a single file (like a zip file, but without the compression - it is actually ext3, but that is unimportant) To put everything 'back together': Create the locations where ...


5

See the schroot package. Man Page As an alternative, you can shorthand the bind mounting with: for f in proc sys dev ; do mount --bind /$f /mnt/$f ; done


4

In order to chroot to do things like.. configure/install grub, do the following- #first, mount new install to /mnt/oneiric mount -t proc proc /mnt/oneiric/proc mount -t sysfs sys /mnt/oneiric/sys mount -o bind /dev /mnt/oneiric/dev chroot /mnt/oneiric /bin/bash I wouldn't try to start full gnome this way. The only reason you should really be doing this ...


4

Many developers use pbuilder for this task. There is a very comprehensive guide to pbuilder on the Ubuntu wiki. You might also look into the pbuilder-dist script. It is a is a wrapper that makes it easy to use pbuilder with many different versions of Ubuntu and/or Debian. It is available in the ubuntu-dev-tools package.


4

SU connects you as root. The terminal will remain as root for the session. With sudo (superuser do) you can perform operations as root while connected as a regular user.


4

Ok found out the solution to this, I hope it helps some people out. The user is jailed to /var/www/sites. I then created another folder /var/www/sites/site1. I chown root:webmaster /var/www/sites/site1 as well as chmod 775 /var/www/sites/site1 . This enabled the home directory to have the correct permissions to login and then be able to write to the next ...


4

On newer Ubuntu systems, name resolution is handled by the resolvconf service, and /etc/resolv.conf is a symbolic link to /run/resolvconf/resolv.conf. You can either add a bind mount to the /run filesystem along with your other bind mounts before executing the chroot command sudo mount -o bind /run /mnt/run so that the chroot system picks up the host ...


3

Within a chroot, it is likely that resolv.conf is not properly set up (it could be a symlink to a non-existent file, or it could be empty and so on). Therefore a common bit of advice when setting up chroots is to copy the host's resolv.conf: mv chroot/etc/resolv.conf{,.bak} cp /etc/resolv.conf chroot/etc/resolv.conf Then you can restore the original, if ...


3

I feel like nobody gave a full technical explanation, so here goes. To understand a chroot you first have to understand the split between kernel (The Linux in GNU/Linux) and userspace (the GNU in GNU/Linux, or possibly something else, like busybox.) The kernel controls all the hardware in your computer. It also provides the APIs for file access, ...


3

You can't really run upstart itself in a chroot. For it to work, you'd need something like an LXC container. Unfortunately most Android kernels don't have the required options to allow LXC to work. Without LXC, the way of getting a chroot on your phone is to run: sudo debootstrap --foreign --arch=armhf precise precise then copy precise/ to your phone then ...



Only top voted, non community-wiki answers of a minimum length are eligible