0

As a reference, I'm on Ubuntu 12.04.5

I feel like I've looked at a hundred of these and for some reason, none have worked. This is most likely due to a lack of understanding on my part about what exactly I'm doing. What I'm trying to do is set up a user, and only let that user have access to their directory and anything under their home directory. However, I do not want them to be able to access anything above this home directory (meaning they should not be allowed to change the directory by doing cd .. while in /home/username).

Here are the steps I've taken:

  1. Set up the user username.
  2. Added the user to a special group so that they and other users could edit some files, we can call this sgroup.
  3. Set up the files username needs to be able to run things like mysql, ls, vim, etc. by issuing the following commands:

    [AS ROOT]
    mount --rbind /bin /home/username/sprg/bin
    mount --rbind /dev /home/username/sprg/dev
    mount --rbind /etc /home/username/sprg/etc
    mount --rbind /lib /home/username/sprg/lib
    mount --rbind /proc /home/username/sprg/proc
    mount --rbind /sbin /home/username/sprg/sbin
    mount --rbind /sys /home/username/sprg/sys
    mount --rbind /usr /home/username/sprg/usr
    

root currently owns everything under sprg including the folder itself.

  1. Edited /etc/ssh/sshd_config and changed the line: Subsystem sftp /usr/lib/openssh/sftp-server to Subsystem sftp internal-sftp. At the end of the file, I added the following:

    Match user username
        ChrootDirectory /home/username
        AllowTCPForwarding no
        ForceCommand internal-sftp
    
  2. Restarted ssh via sudo service ssh restart.

Now, when I change my user to username via su - username, I am still able to view files and folders outside of my /home/username directory. Also note that root owns /home/username.

To wrap it up, all I'm looking to do is have the user log into a terminal via ssh, get directed to their home directory (which already happens), and then disallows them from ever accessing another directory UNLESS it is under /home/username. In which case, they are free to do as they please under that directory.

Any help would be appreciated!

  • Have you tried rbash? It's a restricted shell that prevents many things, including changing directories. – Nonny Moose Apr 11 '17 at 23:57
  • Have looked into using selinux to do this? I think I recall that being a configurable option using selinux – Gansheim Apr 12 '17 at 2:01
  • @NonnyMoose I don't want to completely prevent changing directories though. If the user makes a folder under their home directory, I want them to be able to move into it. Does rbash completely disallow cd? – Alex Apr 12 '17 at 2:06
2

Now, when I change my user to username via su - username, I am still able to view files and folders outside of my /home/username directory. Also note that root owns /home/username.

Restrictions on SSH aren't going to affect su. The settings seem fine to me, so you should test it by doing ssh username@localhost and sftp username@localhost. Since you have said that the user logs in via SSH, given these settings, su shouldn't be a problem.

  • I almost just said that. I really should read. ;) – Nonny Moose Apr 12 '17 at 11:45
  • Also note that if the user can become root they can break out of the chroot. – Nonny Moose Apr 12 '17 at 11:46
  • That seems to be the problem. bash ends up not being started because I assume it's looking for /bin/bash instead of /home/username/sprg/bin/bash. I updated the PATH variable in .bashrc and in .profile. It still seems to disconnect without warning. Is there a way I can do this? – Alex Apr 12 '17 at 19:04
  • @Alex you have forced SFTP. Only SFTP should work. – muru Apr 12 '17 at 19:15
  • @muru how can I allow SFTP and SSH? – Alex Apr 12 '17 at 19:15

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.