I discover to my delight that creating a chroot environment for restricted users over ssh on my ubuntu server is really really easy. It must be many years since I last tried this, because I remember it was much more painful.
I ended up creating a separate area under /home for chroot environments;
# ls -ld chroot/
drwxr-xr-x 4 root root 4096 2011-07-08 22:03 chroot/
I also create a group for the restricted users;
# addgroup sandbox
Under chroot I add the restricted users;
# adduser --home /home/chroot/resuser1 resuser1
# adduser resuser1 sandbox
I wanted the restricted users to use rssh as a shell, so I edited the user entry in /etc/passwd;
resuser1:x:1001:1001:NN,,,:/resuser1:/usr/bin/rssh
Note the home directory path that is prefixed simply with /.
Then I enabled only the two services I wanted to allow with rssh, in /etc/rssh.conf:
# Leave these all commented out to make the default action for rssh to lock
# users out completely...
allowscp
allowsftp
#allowcvs
#allowrdist
#allowrsync
#allowsvnserve
Then you need to add some magic statements in your /etc/ssh/ssh_config file:
# chroot stuff
Subsystem sftp internal-sftp
Match group sandbox
ChrootDirectory /home/chroot
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
I needed to comment out a previous Subsystem command as well.
Then restart the ssh daemon:
# /etc/init.d/ssh restart
And that’s it.
For debugging, you might want to tail the auth.log;
# tail -f /var/log/auth.log
..whilst you log on from a client;
$ sftp resuser1@myhost.com
resuser1@myhost.com's password:
Connected to myhost.com.
sftp> pwd
Remote working directory: /resuser1
Recent comments