From owner-freebsd-questions@freebsd.org Wed Dec 16 15:50:09 2015 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 49409A49C40 for ; Wed, 16 Dec 2015 15:50:09 +0000 (UTC) (envelope-from mike@sentex.net) Received: from smarthost1.sentex.ca (smarthost1.sentex.ca [IPv6:2607:f3e0:0:1::12]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client CN "smarthost.sentex.ca", Issuer "smarthost.sentex.ca" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 028A31156 for ; Wed, 16 Dec 2015 15:50:08 +0000 (UTC) (envelope-from mike@sentex.net) Received: from [IPv6:2607:f3e0:0:4:f025:8813:7603:7e4a] (saphire3.sentex.ca [IPv6:2607:f3e0:0:4:f025:8813:7603:7e4a]) by smarthost1.sentex.ca (8.15.2/8.15.2) with ESMTP id tBGFo8SB046081 for ; Wed, 16 Dec 2015 10:50:08 -0500 (EST) (envelope-from mike@sentex.net) To: freebsd-questions From: Mike Tancsa X-Enigmail-Draft-Status: N1110 Organization: Sentex Communications Subject: sftp, syslog level, chrooted users in a jail Message-ID: <5671882E.3040509@sentex.net> Date: Wed, 16 Dec 2015 10:50:06 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.4.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 2.75 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Dec 2015 15:50:09 -0000 I am trying to increase the verbosity of sftp's syslog, but am running into a problem because the users are chrooted and ssh is running in a jail. My setup -- simple qjail with defaults I have inside, the user test1sftp:*:1002:1002:User &:/home/test1:/bin/false and in /etc/ssh/sshd_config I have Match user * ChrootDirectory %h ForceCommand internal-sftp -l debug1 AllowTcpForwarding no PermitTunnel no X11Forwarding no /home/test1sftp # ls -l /home/test1sftp total 27 drwxr-xr-x 5 root wheel uarch 5 Dec 16 10:04 . drwxrwxr-x 2 root wheel uarch 4 Dec 16 10:37 dev drwxr-xr-x 3 test1sftp test1sftp uarch 6 Dec 16 10:37 uploadhere In the dev directory, if I make # ls -l /home/test1sftp/dev/ total 2 drwxrwxr-x 2 root wheel uarch 4 Dec 16 10:37 . drwxr-xr-x 5 root wheel uarch 5 Dec 16 10:04 .. srw-rw-rw- 2 root wheel uarch 0 Dec 16 10:05 log srw------- 2 root wheel uarch 0 Dec 16 10:05 logpriv ln /var/run/logpriv logpriv ln /var/run/log log I can get it to work. 10:44:58 sshd 10:44:58 sshd: Accepted publickey for test1sftp from xxxx port 30534 ssh2: RSA 51:2e:.... 10:44:58 sshd: User child is on pid 83522 10:44:58 sshd: Changed root directory to "/home/test1sftp" 10:44:58 sshd: Starting session: forced-command (config) 'internal-sftp -l verbose' for test1sftp from xxx port 30534 10:44:58 internal-sftp 10:44:58 internal-sftp: received client version 3 10:44:58 internal-sftp: realpath "." 10:45:00 /usr/sbin/cron: (root) CMD (/usr/libexec/atrun) 10:45:02 internal-sftp: realpath "/uploadhere" 10:45:02 internal-sftp: stat name "/uploadhere" 10:45:04 internal-sftp: opendir "/uploadhere/" 10:45:04 internal-sftp: closedir "/uploadhere/" 10:45:04 internal-sftp: lstat name "/uploadhere/valid-ip.c" 10:45:04 internal-sftp: lstat name "/uploadhere/valid-ip.c" 10:45:04 internal-sftp: remove name "/uploadhere/valid-ip.c" 10:45:09 internal-sftp: open "/uploadhere/valid-ip.c" flags WRITE,CREATE,TRUNCATE mode 0644 10:45:09 internal-sftp: close "/uploadhere/valid-ip.c" bytes read 0 written 615 10:45:10 internal-sftp: opendir "/uploadhere" 10:45:10 internal-sftp: closedir "/uploadhere" 10:45:11 internal-sftp 10:45:11 sshd: Received disconnect from xxxx: 11: disconnected by user I have a few hundred users. Apart from creating dev/log hard links for every home directory, is there a different way to go about this ? Are there any security issues I need to be aware of ? ---Mike -- ------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike@sentex.net Providing Internet services since 1994 www.sentex.net Cambridge, Ontario Canada http://www.tancsa.com/