Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 18 Dec 2015 17:25:58 -0500
From:      mike tancsa <mike@sentex.net>
To:        Ernie Luzar <luzar722@gmail.com>
Cc:        "freebsd-questions" <freebsd-questions@freebsd.org>
Subject:   Re: sftp, syslog level, chrooted users in a jail
Message-ID:  <151b73318f0.2765.e68d32c7521a042b3773fe36a0156dc7@sentex.net>
In-Reply-To: <56748142.4030907@gmail.com>
References:  <5671882E.3040509@sentex.net> <56748142.4030907@gmail.com>

next in thread | previous in thread | raw e-mail | index | archive | help
Hi, thanks for the reply. Yes, all the users (a few hundred) are all in one 
jail. However the users must be chrooted into their own directories for 
security reasons. Hence, I cannot remove the chroot option and am left with 
the issue of logging



On December 18, 2015 4:57:11 PM Ernie Luzar <luzar722@gmail.com> wrote:

> Mike Tancsa wrote:
>> I am trying to increase the verbosity of sftp's syslog, but am running
>> into a problem because the users are chrooted and ssh is running in a jail.
>>
>> My setup -- simple qjail with defaults
>>
>> I have inside, the user
>>
>> test1sftp:*:1002:1002:User &:/home/test1:/bin/false
>>
>> and in /etc/ssh/sshd_config I have
>>
>> Match user *
>>    ChrootDirectory %h
>>    ForceCommand internal-sftp -l debug1
>>    AllowTcpForwarding no
>>    PermitTunnel no
>>    X11Forwarding no
>>
>> /home/test1sftp
>>
>> # ls -l /home/test1sftp
>> total 27
>> drwxr-xr-x    5 root       wheel      uarch   5 Dec 16 10:04 .
>> drwxrwxr-x    2 root       wheel      uarch   4 Dec 16 10:37 dev
>> drwxr-xr-x    3 test1sftp  test1sftp  uarch   6 Dec 16 10:37 uploadhere
>>
>>
>> In the dev directory, if I make
>> # ls -l /home/test1sftp/dev/
>> total 2
>> drwxrwxr-x  2 root  wheel  uarch 4 Dec 16 10:37 .
>> drwxr-xr-x  5 root  wheel  uarch 5 Dec 16 10:04 ..
>> srw-rw-rw-  2 root  wheel  uarch 0 Dec 16 10:05 log
>> srw-------  2 root  wheel  uarch 0 Dec 16 10:05 logpriv
>>
>>
>>
>> ln /var/run/logpriv logpriv
>> ln /var/run/log log
>>
>> I can get it to work.
>>
>>
>> 10:44:58  sshd
>> 10:44:58  sshd: Accepted publickey for test1sftp from xxxx port 30534
>> ssh2: RSA 51:2e:....
>> 10:44:58  sshd: User child is on pid 83522
>> 10:44:58  sshd: Changed root directory to "/home/test1sftp"
>> 10:44:58  sshd: Starting session: forced-command (config) 'internal-sftp
>> -l verbose' for test1sftp from xxx  port 30534
>> 10:44:58  internal-sftp
>> 10:44:58  internal-sftp: received client version 3
>> 10:44:58  internal-sftp: realpath "."
>> 10:45:00  /usr/sbin/cron: (root) CMD (/usr/libexec/atrun)
>> 10:45:02  internal-sftp: realpath "/uploadhere"
>> 10:45:02  internal-sftp: stat name "/uploadhere"
>> 10:45:04  internal-sftp: opendir "/uploadhere/"
>> 10:45:04  internal-sftp: closedir "/uploadhere/"
>> 10:45:04  internal-sftp: lstat name "/uploadhere/valid-ip.c"
>> 10:45:04  internal-sftp: lstat name "/uploadhere/valid-ip.c"
>> 10:45:04  internal-sftp: remove name "/uploadhere/valid-ip.c"
>> 10:45:09  internal-sftp: open "/uploadhere/valid-ip.c" flags
>> WRITE,CREATE,TRUNCATE mode 0644
>> 10:45:09  internal-sftp: close "/uploadhere/valid-ip.c" bytes read 0
>> written 615
>> 10:45:10  internal-sftp: opendir "/uploadhere"
>> 10:45:10  internal-sftp: closedir "/uploadhere"
>> 10:45:11  internal-sftp
>> 10:45:11  sshd: Received disconnect from xxxx: 11: disconnected by user
>>
>>
>> I have a few hundred users. Apart from creating dev/log hard links for
>> every home directory, is there a different way to go about this ?
>>
>> Are there any security issues I need to be aware of ?
>>
>> 	---Mike
>>
>
> Let me be sure I understand your setup correctly, ssh, sftp, and all the
> users are defined in the same jail.
>
> In the jail remove  ChrootDirectory %h option from sshd_config.
>





Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?151b73318f0.2765.e68d32c7521a042b3773fe36a0156dc7>