Date: Mon, 20 Dec 2004 16:19:29 -0600 From: Nigel Houghton <nigel@sourcefire.com> To: Brett Glass <brett@lariat.org> Cc: freebsd-security@freebsd.org Subject: Re: chroot-ing users coming in via SSH and/or SFTP? Message-ID: <20041220221928.GA2698@sourcefire.com> In-Reply-To: <6.2.0.14.2.20041220145924.0624c328@localhost> References: <6.2.0.14.2.20041220142255.06260ca0@localhost> <20041220212304.GV792@sourcefire.com> <6.2.0.14.2.20041220145924.0624c328@localhost>
next in thread | previous in thread | raw e-mail | index | archive | help
On 0, Brett Glass <brett@lariat.org> allegedly wrote: > At 02:23 PM 12/20/2004, Nigel Houghton wrote: > > >Is there something wrong with using the scponly shell for the users? > > Mainly that I hadn't heard of it until you mentioned it. ;-) > Thank you! (I knew I could get a quick answer, if there was one, > from the list.) aha, ok, good. > I just tried building it (twice, because the first time I didn't > realize that it required a special variable to be defined before > it would set itself up to chroot users). I'll be testing it shortly > to be sure that the "jails" created by its sample script (which > creates both the user ID and the jail) have everything needed for > FreeBSD. > > It'd be nice if there were a more centralized "chroot" facility > that covered SSH, FTP, and other things as well. > > --Brett Take a look at the Jail project, you'll find it here... http://www.jmcresearch.com/projects/jail/ ..and in ports/sysutils/ along with some other jail tools, it may provide some of the features you are looking for. +-----------------------------------------------------------------+ Nigel Houghton Research Engineer Sourcefire Inc. Vulnerability Research Team Stewie: You know, I rather like this God fellow. Very theatrical, you know. Pestilence here, a plague there. Omnipotence ...gotta get me some of that.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20041220221928.GA2698>