0

The server has set up chroot environment.Users can access the server by sftp. More than that,they need to use git aslo.I was following this link creating-chroot-jail-ssh-access,copied /bin/bash /usr/bin/git-shell to the /home/someuser/bin/bashand /home/someuser/usr/bin/git-shell and also the l2chroot part.

/home/someuser/lib#ls -al -R

total 12 drwxr-xr-x 3 git git 4096 Jul 24 15:21 . drwxr-xr-x 25 root root 4096 Jul 24 15:21 .. drwxr-xr-x 2 git git 4096 Jul 24 15:21 x86_64-linux-gnu

./x86_64-linux-gnu: total 2888 drwxr-xr-x 2 git git 4096 Jul 24 15:21 . drwxr-xr-x 3 git git 4096 Jul 24 15:21 .. -rwxr-xr-x 1 git git 1868984 Jul 24 15:21 libc.so.6 -rw-r--r-- 1 git git 14608 Jul 24 15:21 libdl.so.2 -rw-r--r-- 1 git git 456632 Jul 24 15:21 libpcre.so.3 -rwxr-xr-x 1 git git 138696 Jul 24 15:21 libpthread.so.0 -rw-r--r-- 1 git git 31712 Jul 24 15:21 librt.so.1 -rw-r--r-- 1 git git 130224 Jul 24 15:21 libselinux.so.1 -rw-r--r-- 1 git git 167240 Jul 24 15:21 libtinfo.so.5 -rw-r--r-- 1 git git 104864 Jul 24 15:21 libz.so.1

But I login with someuser it complains:

Last login: Mon Jul 24 16:59:19 2017 from 114.***.189

/usr/bin/git-shell: Not a directory

First I want git users be able to use git.Second don't want them be able to read every file on system. How to make it work?

UPDATE: sshd_config sftp part

Subsystem sftp internal-sftp -f AUTH -l INFO
Match group sftpusers
  ChrootDirectory %h
  ForceCommand internal-sftp -l INFO -f AUTH
  AllowTcpForwarding no
  X11Forwarding no

Match group git
  ChrootDirectory /home/%u
  X11Forwarding no
  AllowTcpForwarding no
1

If you want to have a git in chroot (there is no good reason to do that once you will not allow shell access), you need to include the executable in the chroot. Just copy the one from the system (including all the dynamically linked libraries).

  • so could forbid the sftp use for the git user? just don't want them have read ability everywhere. – Shihe Zhang Jul 24 '17 at 15:26
  • You didnt write anything about your configuration, but if you use ForceCommnd in sshd_config, it will not allow sftp connections. – Jakuje Jul 24 '17 at 15:35
  • add my sshd_config.First I want git users be able to use git.Second don't want them be able to read every file on system. – Shihe Zhang Jul 25 '17 at 0:56
  • That is exactly what forcecommand /usr/bin/git-shell does – Jakuje Jul 25 '17 at 5:12
  • I was using chsh git to /usr/bin/git-shell.And it complains /usr/bin/git-shell: Not a directory.After using forcomand /usr/bin/git-shell and restart sshd it complains same way. – Shihe Zhang Jul 25 '17 at 5:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.