Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > Linux Forums > Installation/Configuration

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 5th March 2012, 01:44
gragus gragus is offline
Junior Member
 
Join Date: Sep 2011
Posts: 10
Thanks: 0
Thanked 1 Time in 1 Post
Default Automatically chroot'ing ISPConfig 2 users

(I posted in another forum section previously, but did not get any replies. Chroot'ing ISPConfig users must be a common issue. Reposting here, perhaps this is a more suitable forum section. Any help is greatly appreciated!)

Issue:

Activating chroot'ed users via $go_info["server"]["ssh_chroot"] = 1 does not actually result in chroot'ing.

I followed the instructions from the links below to set up a chroot-capable SSHD and activated the ISPConfig option. It looks like the home dir created by ISPConfig for new users has a "." in it as required, and that the files necessary for the jail to work are copied into the site directory, but the chroot'ing is not active - the users that meant to be chroot'ed can browse the entire file system.

System configuration:

Ubuntu 10.04.4 LTS
configured as explained in the Perfect Server Manual (thanks Falko, Til & Co for the awesome work). It's a cloud-box, so I started in the middle of step 7.

ISPConfig Version: 2.2.40

Aiming to set up chroot'ed users with ISPConfig I looked at a few sources:
  1. http://www.howtoforge.com/chrooted_ssh_howto_debian
  2. http://www.howtoforge.com/restrictin...debian-squeeze
  3. http://www.howtoforge.com/forums/sho...+ssh+ispconfig
  4. http://www.howtoforge.com/forums/showthread.php?t=4373

Essentially, [1] and [2] say that you need to first enable an SSH host that supports chroot'ing and then go on to explain how to copy files essential for a chroot'ed user. Although [1] says that you need to download and build a modified server, that article is quite old, and from [2] it seems that these days it is sufficient to install OpenSSH (also hinted on here).

From [3] and [4] you learn that once you have a chroot-capable SSH host, you just need to set the flag '$go_info["server"]["ssh_chroot"]' in file '/home/admispconfig/ispconfig/lib/config.inc.php'. That will use the script '/root/ispconfig/scripts/shell/create_chroot_env.sh' to set up the necessary files for new users created by ISPConfig.

I did all of the above, but things do not work.
I see that files that should be copied by create_chroot_env.sh are indeed copied and that new users have a dot in their home directory path. However, when logging in under such a user I can see the entire file system which implies that I am not chroot'ed.

I am not sure how to diagnose the issue. Is there a way to check that the active SSH host is the one I need and that it supports chroot'ing? What else could I be missing? Do I perhaps require some 'Match' configuration blocks in the SSHD config file as described in [2]? If so, how should they look like to interop well with ISPConfig?

Diagnostics:

Here are some snippets from my system config/diagnostics that may be relevant:

/home/admispconfig/ispconfig/lib/config.inc.php:
Code:
...
$go_info["server"]["ssh_chroot"] = 1;
...
/etc/ssh/sshd_config:

Code:
...
#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp

UsePAM yes
(end of file)
root@MyServer:~# ps flax:

Code:
F   UID   PID  PPID PRI  NI    VSZ   RSS WCHAN  STAT TTY        TIME COMMAND
. . .
4     0  1985     1  20   0   5600  2132 -      Ss   ?          0:00 /usr/sbin/sshd -D
4     0  2033  1985  20   0   8408  2820 -      Ss   ?          0:00  \_ sshd: root@notty
5     0  2315  2033  20   0   8508  1440 -      Ss   ?          0:00  |   \_ sshd: root@internal-sftp
4     0 21230  1985  20   0   8408  2740 -      Ss   ?          0:00  \_ sshd: MyUser [priv]
5 10001 21296 21230  20   0   8540  1460 -      S    ?          0:00  |   \_ sshd: MyUser@pts/0
0 10001 21297 21296  20   0   4592  1864 -      Ss   pts/0      0:00  |       \_ -bash
0 10001 21304 21297  20   0   6980  2848 -      S+   pts/0      0:00  |           \_ mc
0 10001 21306 21304  20   0   4608  1872 -      Ss+  pts/1      0:00  |               \_ bash -rcfile .bashrc
4     0 21426  1985  20   0   8408  2684 -      Ss   ?          0:00  \_ sshd: MyUser [priv]
5 10001 21488 21426  20   0   8540  1456 -      S    ?          0:00  |   \_ sshd: MyUser@notty
1 10001 21491 21488  20   0   8508  1252 -      Ss   ?          0:00  |       \_ sshd: MyUser@internal-sftp
4     0 21585  1985  20   0   8544  2808 -      Ss   ?          0:00  \_ sshd: root@pts/2
4     0 21647 21585  20   0   4632  1872 -      Ss   pts/2      0:00      \_ -bash
0     0 21662 21647  20   0   7528  3508 -      S+   pts/2      0:00          \_ mc
0     0 21664 21662  20   0   4636  1896 -      Ss   pts/3      0:00              \_ bash -rcfile .bashrc
4     0 21795 21664  20   0   2692   900 -      R+   pts/3      0:00                  \_ ps flax
. . .
Thanks!
Reply With Quote
Sponsored Links
 

Bookmarks

Tags
chroot, ispconfig 2

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Automatically chroot'ing users in ISPConfig 2 gragus Installation/Configuration 3 6th May 2013 15:30
SquirrelMail login not working glenneh Installation/Configuration 13 9th April 2011 20:01
ISPConfig 3.0.0.7 Beta released till General 78 24th December 2008 11:47
ISPConfig won't start automatically? JoePorge Installation/Configuration 6 1st July 2008 19:32
Junk mail and spamassassin... sthompson Installation/Configuration 4 27th December 2006 16:11


All times are GMT +2. The time now is 05:38.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.