Date: Thu, 02 Oct 2008 20:17:02 +0100 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: kalin m <kalin@el.net> Cc: freebsd-questions@freebsd.org Subject: Re: ssh jail Message-ID: <48E51E2E.90500@infracaninophile.co.uk> In-Reply-To: <48E5070D.8050400@el.net> References: <48E5070D.8050400@el.net>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig8FD55FBC995DE8AD1C0091CD
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable
kalin m wrote:
>=20
> hi all...
>=20
> i have openssh 5. i want to jail the users to their home directories so=
=20
> they can go down but not up.
>=20
> i didn't see a directive that does that in the man or in the sshd_confi=
g.
>=20
> how do i do that?
You need a specially patched version of OpenSSH. You can download
the patches from here:
http://chrootssh.sourceforge.net/download/
and try patching the system sources. If you're not an experienced
developer wise in the ways of patch(1) and diff(1) and make(1) this
definitely isn't a good idea especially for something as security
sensitive as OpenSSH.
Realistically, just install the security/openssh-portable port and
make sure to check the 'OPENSSH_CHROOT' box in the config dialog.
Note: if you choose to select the 'OVERWRITE_BASE' option, be sure
to disable building ssh in the base system by making the appropriate
entries in /etc/src.conf (see src.conf(5)) or otherwise ensure that
whatever system update mechanism you use won't accidentally blow away
your specially patched ssh daemon.
If you don't overwrite the base system, then double check that the
init scripts are starting up the openssh-portable version. You'll
need at least this in /etc/rc.conf:
sshd_enable=3D"NO"
openssh_enable=3D"YES"
Cheers,
Matthew
--=20
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
Kent, CT11 9PW
--------------enig8FD55FBC995DE8AD1C0091CD
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (FreeBSD)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEAREIAAYFAkjlHjQACgkQ8Mjk52CukIx8hACgkxPwEQ9yldjr3z23hkywhSH/
fmwAoJKwNeqnyeTeWB82y3ueEfsWohP7
=Zuc6
-----END PGP SIGNATURE-----
--------------enig8FD55FBC995DE8AD1C0091CD--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?48E51E2E.90500>