From owner-freebsd-stable@freebsd.org  Sat Aug 22 15:01:58 2015
Return-Path: <owner-freebsd-stable@freebsd.org>
Delivered-To: freebsd-stable@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 5FB7C9BF850
 for <freebsd-stable@mailman.ysv.freebsd.org>;
 Sat, 22 Aug 2015 15:01:58 +0000 (UTC)
 (envelope-from allbery.b@gmail.com)
Received: from mail-lb0-x22c.google.com (mail-lb0-x22c.google.com
 [IPv6:2a00:1450:4010:c04::22c])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id DBA7B1AA5
 for <freebsd-stable@freebsd.org>; Sat, 22 Aug 2015 15:01:57 +0000 (UTC)
 (envelope-from allbery.b@gmail.com)
Received: by lbbsx3 with SMTP id sx3so58634069lbb.0
 for <freebsd-stable@freebsd.org>; Sat, 22 Aug 2015 08:01:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:in-reply-to:references:date:message-id:subject:from:to
 :cc:content-type;
 bh=Gdaz6Cs8QbU5wz3iYWdXURkxVtZfSLR9HuVgi5kKgwA=;
 b=j1s+vOZKWCR7rwXg3G14SlK+BK73lTlaFRlIhWr3XR/Ve8qO3TNH1AV9WO4fjTHd/I
 LWCrOU2doNQ6cqX0xL5QJtyCSo100DuNlWR4T2rtDOGa09xd68iEzRLU4SvunA7VRAdp
 wJyBTYT3LtIlQLaRLXjq/gwBZZmZ6AJ3kWKh69y4FXtqwgVgWrUnQtroRZykkRCfRl35
 HA3I7lVTWk9d76fphLnssKpYnwTY2tLZcuyZRImtJOeRd4XYn+nGV3tkI1Ixh8IKCygR
 +tpIT6vYmTRO0EjZzMBxuRsjWOMvKIhFAP9ki3L2+oy9m5C+3aqAeAIOy5EiJWj7+dJE
 ckiQ==
MIME-Version: 1.0
X-Received: by 10.112.161.137 with SMTP id xs9mr12884178lbb.4.1440255714844;
 Sat, 22 Aug 2015 08:01:54 -0700 (PDT)
Received: by 10.25.134.198 with HTTP; Sat, 22 Aug 2015 08:01:54 -0700 (PDT)
In-Reply-To: <F77B357B-3DD3-40AC-A16F-027FAC9CA136@ultra-secure.de>
References: <55D879DA.1070407@gmail.com>
 <CAKFCL4V=bUiHo4Mtjw67sYRddC6fbodS3koYg5qZkExr6BueRw@mail.gmail.com>
 <F77B357B-3DD3-40AC-A16F-027FAC9CA136@ultra-secure.de>
Date: Sat, 22 Aug 2015 11:01:54 -0400
Message-ID: <CAKFCL4UYcJYmXLLKxatnRAEQftJ_2bgAbgMdfKiGm-0o6JSGjA@mail.gmail.com>
Subject: Re: SSH Chroot FreeBSD 10.1 and 10.2
From: Brandon Allbery <allbery.b@gmail.com>
To: Rainer Duffner <rainer@ultra-secure.de>
Cc: Johan Hendriks <joh.hendriks@gmail.com>,
 freebsd-stable <freebsd-stable@freebsd.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Content-Filtered-By: Mailman/MimeDel 2.1.20
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-stable>, 
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable/>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 22 Aug 2015 15:01:58 -0000

On Sat, Aug 22, 2015 at 10:54 AM, Rainer Duffner <rainer@ultra-secure.de>
wrote:

> I found it=E2=80=99s much easier to have actual chroot=E2=80=99ed ssh use=
rs once the users
> themselves are in an LDAP-directory.
> Also, for doing anything useful on that shell, it turned out you need a
> some more devices in /dev than the usual chroot (like a chroot=E2=80=99ed=
 PHP-FPM,
> that just needs the dev-set of jail(4)).
> And a couple of symlinks.
>

Yep; chroots are always a pain to deal with. I have seen utilities to
manage them, but only for Linux.

--=20
brandon s allbery kf8nh                               sine nomine associate=
s
allbery.b@gmail.com                                  ballbery@sinenomine.ne=
t
unix, openafs, kerberos, infrastructure, xmonad        http://sinenomine.ne=
t