From owner-freebsd-security Fri Jun 28 18:34:33 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 42E3337B401 for ; Fri, 28 Jun 2002 18:34:28 -0700 (PDT) Received: from gate.volant.org (gate.volant.org [207.111.218.246]) by mx1.FreeBSD.org (Postfix) with ESMTP id C4ECF43E09 for ; Fri, 28 Jun 2002 18:34:27 -0700 (PDT) (envelope-from patl+freebsd@volant.org) Received: from 216-55-134-176.dsl.san-diego.abac.net ([216.55.134.176] helo=[192.168.0.13]) by gate.volant.org with asmtp (TLSv1:DES-CBC3-SHA:168) (Exim 3.33 #1) id 17O77z-000Nuf-00; Fri, 28 Jun 2002 18:34:19 -0700 Date: Fri, 28 Jun 2002 18:34:04 -0700 From: Pat Lashley To: Poul-Henning Kamp Cc: FreeBSD Security Mailling List Subject: Re: Jailing SSHd Message-ID: <188970000.1025314444@mccaffrey.phoenix.volant.org> X-Mailer: Mulberry/2.2.1 (Linux/x86 Demo) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org --On Saturday, June 29, 2002 12:28:35 AM +0200 Poul-Henning Kamp=20 wrote: > In message <2849830000.1025137373@mccaffrey.phoenix.volant.org>, Pat > Lashley wr ites: >> >> --On Wednesday, June 26, 2002 09:07:36 PM +0200 Poul-Henning Kamp=3D20 >> wrote: >> >>> Which reminds me that we should really tweak the code and put it in a >>> jail instead of a chroot. >> >> Careful there. Some of us are using SSH to log into jails running >> virtual hosting environments. The default installation needs to be able >> to run if it is already within a jail when sshd is started. > > You could just fall back to chroot(2) if jail(2) failed. My point is that the DEFAULT installation and configuration must Do The Right Thing whether it is run in a jail or in the main server environment. An acceptable solution would be a startup script which was either smart enough to recognize when it is running in a jail, or which implements a chroot fallback if the attempt to jail the sshd fails. -Pat To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message