Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > Linux Forums > Installation/Configuration

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Reply
 
Thread Tools Display Modes
  #1  
Old 5th March 2012, 01:44
gragus gragus is offline
Junior Member
 
Join Date: Sep 2011
Posts: 10
Thanks: 0
Thanked 1 Time in 1 Post
Default Automatically chroot'ing ISPConfig 2 users

(I posted in another forum section previously, but did not get any replies. Chroot'ing ISPConfig users must be a common issue. Reposting here, perhaps this is a more suitable forum section. Any help is greatly appreciated!)

Issue:

Activating chroot'ed users via $go_info["server"]["ssh_chroot"] = 1 does not actually result in chroot'ing.

I followed the instructions from the links below to set up a chroot-capable SSHD and activated the ISPConfig option. It looks like the home dir created by ISPConfig for new users has a "." in it as required, and that the files necessary for the jail to work are copied into the site directory, but the chroot'ing is not active - the users that meant to be chroot'ed can browse the entire file system.

System configuration:

Ubuntu 10.04.4 LTS
configured as explained in the Perfect Server Manual (thanks Falko, Til & Co for the awesome work). It's a cloud-box, so I started in the middle of step 7.

ISPConfig Version: 2.2.40

Aiming to set up chroot'ed users with ISPConfig I looked at a few sources:
  1. http://www.howtoforge.com/chrooted_ssh_howto_debian
  2. http://www.howtoforge.com/restrictin...debian-squeeze
  3. http://www.howtoforge.com/forums/sho...+ssh+ispconfig
  4. http://www.howtoforge.com/forums/showthread.php?t=4373

Essentially, [1] and [2] say that you need to first enable an SSH host that supports chroot'ing and then go on to explain how to copy files essential for a chroot'ed user. Although [1] says that you need to download and build a modified server, that article is quite old, and from [2] it seems that these days it is sufficient to install OpenSSH (also hinted on here).

From [3] and [4] you learn that once you have a chroot-capable SSH host, you just need to set the flag '$go_info["server"]["ssh_chroot"]' in file '/home/admispconfig/ispconfig/lib/config.inc.php'. That will use the script '/root/ispconfig/scripts/shell/create_chroot_env.sh' to set up the necessary files for new users created by ISPConfig.

I did all of the above, but things do not work.
I see that files that should be copied by create_chroot_env.sh are indeed copied and that new users have a dot in their home directory path. However, when logging in under such a user I can see the entire file system which implies that I am not chroot'ed.

I am not sure how to diagnose the issue. Is there a way to check that the active SSH host is the one I need and that it supports chroot'ing? What else could I be missing? Do I perhaps require some 'Match' configuration blocks in the SSHD config file as described in [2]? If so, how should they look like to interop well with ISPConfig?

Diagnostics:

Here are some snippets from my system config/diagnostics that may be relevant:

/home/admispconfig/ispconfig/lib/config.inc.php:
Code:
...
$go_info["server"]["ssh_chroot"] = 1;
...
/etc/ssh/sshd_config:

Code:
...
#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp

UsePAM yes
(end of file)
root@MyServer:~# ps flax:

Code:
F   UID   PID  PPID PRI  NI    VSZ   RSS WCHAN  STAT TTY        TIME COMMAND
. . .
4     0  1985     1  20   0   5600  2132 -      Ss   ?          0:00 /usr/sbin/sshd -D
4     0  2033  1985  20   0   8408  2820 -      Ss   ?          0:00  \_ sshd: root@notty
5     0  2315  2033  20   0   8508  1440 -      Ss   ?          0:00  |   \_ sshd: root@internal-sftp
4     0 21230  1985  20   0   8408  2740 -      Ss   ?          0:00  \_ sshd: MyUser [priv]
5 10001 21296 21230  20   0   8540  1460 -      S    ?          0:00  |   \_ sshd: MyUser@pts/0
0 10001 21297 21296  20   0   4592  1864 -      Ss   pts/0      0:00  |       \_ -bash
0 10001 21304 21297  20   0   6980  2848 -      S+   pts/0      0:00  |           \_ mc
0 10001 21306 21304  20   0   4608  1872 -      Ss+  pts/1      0:00  |               \_ bash -rcfile .bashrc
4     0 21426  1985  20   0   8408  2684 -      Ss   ?          0:00  \_ sshd: MyUser [priv]
5 10001 21488 21426  20   0   8540  1456 -      S    ?          0:00  |   \_ sshd: MyUser@notty
1 10001 21491 21488  20   0   8508  1252 -      Ss   ?          0:00  |       \_ sshd: MyUser@internal-sftp
4     0 21585  1985  20   0   8544  2808 -      Ss   ?          0:00  \_ sshd: root@pts/2
4     0 21647 21585  20   0   4632  1872 -      Ss   pts/2      0:00      \_ -bash
0     0 21662 21647  20   0   7528  3508 -      S+   pts/2      0:00          \_ mc
0     0 21664 21662  20   0   4636  1896 -      Ss   pts/3      0:00              \_ bash -rcfile .bashrc
4     0 21795 21664  20   0   2692   900 -      R+   pts/3      0:00                  \_ ps flax
. . .
Thanks!
Reply With Quote
Sponsored Links
  #2  
Old 11th April 2012, 19:23
sgroulx sgroulx is offline
Junior Member
 
Join Date: Feb 2012
Posts: 3
Thanks: 0
Thanked 0 Times in 0 Posts
Exclamation

I have the same result.
If you change the owner of the path for the root user, the connection should work.
chown root.webX -R /var/www/WebX
Reply With Quote
  #3  
Old 11th April 2012, 19:49
till till is online now
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 35,811
Thanks: 821
Thanked 5,339 Times in 4,188 Posts
Default

If i remeber correctly, chrooting in ispconfig 2 requires a recompiled and patched ssh daemon. These patches are not available anymore for recent sshd versions as the maintainer stopped the development a few years ago, for that reason ssh chroot in ispconfig 2 is not working anymore on recent linux distributions. ISPConfig 2 itself is not under developmenet anymore too since the new ispconfig version (ispconfig 3) is available and stable. So ispconfig 2 wont get updates anymore.

You should really consider to use a ispconfig 3 setup on your server, its much more powerfull, easier to install and has full chroot support for ssh users and many more, is actively supported and gets bugfixes and new features.
__________________
Till Brehm
--
Get ISPConfig support and the ISPConfig 3 manual from ispconfig.org.
Reply With Quote
  #4  
Old 6th May 2013, 15:32
hairydog2 hairydog2 is offline
Senior Member
 
Join Date: Oct 2005
Posts: 196
Thanks: 9
Thanked 3 Times in 2 Posts
Default

Quote:
Originally Posted by till View Post
You should really consider to use a ispconfig 3 setup on your server, its much more powerfull, easier to install and has full chroot support for ssh users and many more, is actively supported and gets bugfixes and new features.
But there is no way to upgrade from ispconfig2 to ispconfig3, is there?

With a setup that has scores of websites and hundreds of users, doing it by hand would be a nightmare.
Reply With Quote
  #5  
Old 6th May 2013, 15:55
till till is online now
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 35,811
Thanks: 821
Thanked 5,339 Times in 4,188 Posts
Default

Quote:
But there is no way to upgrade from ispconfig2 to ispconfig3, is there?
No. You cant upgrade from ispconfig 2 to 3 as the website and email setup is completely different.
__________________
Till Brehm
--
Get ISPConfig support and the ISPConfig 3 manual from ispconfig.org.
Reply With Quote
  #6  
Old 6th May 2013, 18:01
hairydog2 hairydog2 is offline
Senior Member
 
Join Date: Oct 2005
Posts: 196
Thanks: 9
Thanked 3 Times in 2 Posts
Default

Ah well.

Is there a way to enable sftp and lock ispconfig2 users to their own directories, as is possible with ftp? I'd like to switch ftp off if possible.
Reply With Quote
Reply

Bookmarks

Tags
chroot, ispconfig 2

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Automatically chroot'ing users in ISPConfig 2 gragus Installation/Configuration 3 6th May 2013 15:30
SquirrelMail login not working glenneh Installation/Configuration 13 9th April 2011 20:01
ISPConfig 3.0.0.7 Beta released till General 78 24th December 2008 11:47
ISPConfig won't start automatically? JoePorge Installation/Configuration 6 1st July 2008 19:32
Junk mail and spamassassin... sthompson Installation/Configuration 4 27th December 2006 16:11


All times are GMT +2. The time now is 13:55.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.