chrooted shell on centos

Discussion in 'Installation/Configuration' started by bwragg, Nov 28, 2006.

  1. bwragg

    bwragg New Member

    Hi all,

    I was just wondering if anyone has got chrooted shells working with ispconfig on centos 4.4. I can't see to get it going. I've followed the guide at http://www.howtoforge.com/chrooted_ssh_howto_debian but when I login as testuser I can see everything on the server.

    When I run pwd it reports:

    Code:
    /home/chroot/./home/testuser
    The same occurs when I login as a new ispconfig site user. Any suggestions?
     
    Last edited: Nov 28, 2006
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Did you enable chrooting in the config.inc.php file and did you update the user afterwards?
     
  3. bwragg

    bwragg New Member

    I did set the setting in config.inc.php to = 1 and I created mulitple new users both on the command line and via ispconfig. So I didn't try updating other users.

    I don't know if its related but I just found that on the site that I added the new user via ispconfig, the other users were unable to retrieve there email via pop3. They could send but not recieve. I checked the maillog and found the following:

    Code:
    pop3-login: Internal login failure: domain.com.au.username
    dovecot: chroot directory no included in valid_chroot_dirs: /var/www/web1/user/domain.com.au.username
    Is this happening because I didn't run the update script over the user?
     
  4. falko

    falko Super Moderator ISPConfig Developer

    What's in /etc/passwd?
     
  5. bwragg

    bwragg New Member

    For a user like root that hasn't been chrooted I have

    Code:
    root:x:0:0:root:/root:/bin/bash
    and for a test user that I've tried to chroot I have

    Code:
    domain.com.au.test:x:10055:10001:test:/var/www/web1/user/domain.com.au.test/./:/bin/bash
    From what I've read, the /./ what is required?

    I'm trying to recompile the openssl file again, incase something went wrong.
     
  6. bwragg

    bwragg New Member

    I just did a recompile with a slightly different ./configure and I seem to be getting a little further. When I restarted the sshd I got an error about the GSSAPIAuthentication setting in the sshd_config file. This is something that ctroyp was getting at
    . I commented out the GSSAPIAuthentication yes line as you suggested falko and sshd restarted ok.

    I next tried logging in as the testuser that I created in the http://www.howtoforge.com/chrooted_ssh_howto_debian_p2 . When I do this (via putty) the window shuts down without an error. Previously I could login and get out of the home dir, but now I can't login at all.

    I next created a user via ispconfig but when I tried logging with putty the window shuts straight away. Previously I could login and get out of the chrooted home dir.

    Additionally any user on the same domain that I created the test user are getting the following error when they try to retrieve their mail via pop3.

    Code:
     dovecot: chroot directory no included in valid_chroot_dirs: /var/www/web1
    pop3-login: Internal login failure: domain.com.au.username 
    All other users on other domains are getting their mail, just not these two. Incidentially these two users are on the same domain as the test user I created above.
    If I set the $go_info["server"]["ssh_chroot"] setting back to 0 and make a change to one of the users on this domain, the mail starts working.

    So I think I'm a little closer, to the problem. Any ideas?
     
  7. falko

    falko Super Moderator ISPConfig Developer

    I think the problem is that you chroot your user to /var/www/web1/user/domain.com.au.test/./, and in that directory dovecot is looking for /var/www/web1 (which expands to /var/www/web1/user/domain.com.au.test/var/www/web1).
     
  8. bwragg

    bwragg New Member

    Thanks falko.

    Any ideas how to stop this? Is it a change in a shell setting or a dovecot setting.

    Cheers,

    Benjamin
     
  9. falko

    falko Super Moderator ISPConfig Developer

    It's a matter of how you set up your chrooot jail.
     
  10. bwragg

    bwragg New Member

    I set it up exactly as the how http://www.howtoforge.com/chrooted_ssh_howto_debian said to. Is there something extra to do?

    While the error with dovecot is a pain, most importantly I can't get the user to stay jailed. This is the main problem, when I fix this maybe the dovecot part will also work.

    I've looked in the sshd_config file but I can't see any relavent settings. Any other ideas?
     
  11. falko

    falko Super Moderator ISPConfig Developer

    But I use /home/chroot as the chroot directory, and then I copy all neded files/directories to that directory.
     
  12. bwragg

    bwragg New Member

    I also do this. I've setup the chroot to be /home/chroot and then I've copied all the files like bash, ls, etc into the appropriate dirs in the /home/chroot/ . I've used ldd to make sure that the correct so's are in the /home/chroot dir.

    I might add that this is running on an amd opteron system with centos 64 bit version. Is there any issues with this?
     
  13. falko

    falko Super Moderator ISPConfig Developer

    But why do you use /var/www/web1/user/domain.com.au.test/./ as the chroot directory for that user? Should rather be /home/chroot/./var/www/web1/user/domain.com.au.test.
     
  14. bwragg

    bwragg New Member

    I can see what your saying, that the home dir should be /home/chroot./var/www/web1/user/domain.com.au.test. but I've never set or changed this, its just how it has always worked. Is there somewhere this can be changed. Is it a setting somewhere? When I create a user via ispconfig this is what it adds to the password file, so is there a setting in ispconfig so it will create the home dir as /home/chroot./var/www/web1/user/domain.com.au.test?
     

Share This Page