"Fossies" - the Fresh Open Source Software Archive 
Member "scponly-20110526/BUILDING-JAILS.TXT" (20 Dec 2005, 7927 Bytes) of package /linux/privat/old/scponly-20110526.tgz:
As a special service "Fossies" has tried to format the requested text file into HTML format (style:
standard) with prefixed line numbers.
Alternatively you can here
view or
download the uninterpreted source code file.
1 Building scponly jail configurations manually.
2 Paul Hyder
3 NOAA Forecast Systems Lab
4 Boulder, CO
5 DRAFT of March 2005
6 paul.hyder@noaa.gov
7
8 Building a jail is almost always >site< specific. There isn't really
9 an easy answer, even if you ignore the OS differences.
10
11 Hence, as you've probably found, building jails is actually not very
12 easily automated.
13
14 At the very least you have to have an idea of the chrooted directory
15 structure that you want for your site. (We use a chrooted multi-user
16 topology with a single central set of NFS mounts. Other sites have
17 individual chrooted environments for each user so that no one sees
18 anyone else. The default script builds individual environments.)
19
20 If someone does provide a script make sure it does what you want.
21 If you don't get something specific that you like it isn't too hard
22 to extract the topology from the default script and build a jail to
23 meet your needs.
24
25 A. Build scponly with your site specific options. Figure out where your
26 specific ssh/scp/rsync/sftp (and other) binaries are. You will also
27 need to know exactly how your sshd is configured, i.e. find the
28 relevant sshd_config file and look at it.
29
30 If you use dsa or rsa keys you should change the sshd_config and put
31 them in an isolated directory that is NOT in the chrooted environment.
32 You are likely to be happier and safer if you move them out of
33 $HOME/.ssh!
34
35 Ssh authentication, keys or passwords, is handled by the top level
36 sshd and the associated sshd_config file. You authenticate normally
37 and then are chrooted into the scponly tree.
38
39 NOTE: Even if you set it up that way, scponly WILL NOT permit root
40 owned sessions, i.e. any session with UID=0
41
42 An "incoming" directory can be created anywhere in the chrooted
43 tree. The default script creates one in the users home directory.
44 The home directory is not user writeable but the incoming sub
45 directory is.
46
47 BTW: If you use the default setup_chroot.sh script, the top level
48 /etc/password file should already contain the scponly users.
49 This is still a good idea if you build the jail manually.
50
51 1. Determine your chrooted topology, user visibilty, and file system
52 mounts. Basically you need to know what >you< want the final
53 chrooted environment to be.
54 a. Choose a location for your alternate root.
55 (We use /altroot/scponly. Users will see a small subset
56 of a normal / configuration after the chroot.)
57 b. Determine the file system mount topology (often NFS) in the
58 chrooted location.
59 c. Decide whether users can see each others files.
60
61 2. Create the chrooted directory location.
62 mkdir /{altroot}
63 /{altroot}
64 /{altroot}/home
65 /{altroot}/home/{username}
66 /{altroot}/home/{username}/incoming
67 /{altroot}/bin
68 /{altroot}/etc
69 /{altroot}/lib
70 /{altroot}/usr
71 /{altroot}/usr/bin
72 /{altroot}/usr/lib
73 /{altroot}/usr/libexec
74 /{altroot}/usr/libexec/openssh
75
76 Where "altroot" is either a single shared location OR
77 multiple single user locations. In the single user
78 topology each user has their own isolated set of
79 all binary files.
80
81 Unless you are !absolutely! sure of your sshd configuration
82 the users home directory, /{altroot}/home/{username} above,
83 should be empty and owned by root and not writeable by the
84 user.
85
86 Synopsis: chrooted home directories are empty, root (0.0)
87 owned, and user readable. (after chroot are just
88 /home/{username})
89
90 Our multi-user configuration has /{altroot}/misc and
91 selected file systems are NFS mounted there. If you
92 do this you probably also will want to install a copy
93 of /etc/group in /{altroot}/etc/group as noted below.
94
95
96 3. Install the subset of commands and libraries. This means you copy them
97 from the equivalent top level directory. This is of course where
98 operating system differences and local utility locations introduce
99 problems. Sadly there isn't a single set, just guidelines. The
100 information below is based on my setup with RedHat Linux.
101
102 See additional notes embedded below.
103
104 /{altroot}/bin
105 chgrp chmod chown ln ls mkdir mv rm rmdir
106
107 This provides the EXPLICIT set of basic commands that work from
108 ssh. Not any more dangerous than leaving sftp. IMPORTANT: $PATH
109 doesn't impact these commands, their location is hard coded in
110 scponly making it difficult or impossible for a user to add
111 commands. There isn't a shell, hence no real $PATH.
112
113 IMPORTANT: If your standard binaries are in another directory you
114 should put them in the right location in the /{altroot} tree
115 instead of /{altroot}/bin. You have to check.
116
117 /{altroot}/etc
118 ld.so.cache ld.so.conf passwd group
119
120 The passwd file is a subset of the /etc/passwd file. The only
121 thing you need is the first part of the line, e.g. an entry in
122 the chrooted passwd file can be edited to look like:
123 auser:x:3444:3000:::
124
125 The passwd file will either have a stripped set of passwd entries
126 for multiple users OR a single line for the single isolated user.
127
128 The group file is only needed in an open multi-user environment.
129
130 The ld.so.cache and/or ld.so.conf may need to be elsewhere
131 depending on the operating system. Look in places like /var/ld.
132
133 /{altroot}/usr/bin
134 rsync scp
135
136 Copy your current rsync and scp binaries if you configured scponly
137 to support them.
138
139 IMPORTANT: If your standard binaries are in another directory you
140 should put them them in the right location in the /{altroot} tree
141 instead of /{altroot}/usr/bin. A common one for scp is
142 /usr/local/bin. Again you have to check.
143
144 /{altroot}/usr/libexec/openssh
145 sftp-server
146
147 Copy your current sftp-server binary if you configured scponly to
148 support sftp.
149
150 IMPORTANT: If your system sftp-server is not in /usr/libexec put
151 it in the right location in the /{altroot} tree.
152
153 /{altroot}/lib
154 ld-linux.so.2 libc.so.6 libdl.so.2 libnsl.so.1
155 libnss_compat-2.2.5.so libnss_compat.so.1
156 libnss_compat.so.2 libtermcap.so.2 libutil.so.1
157 /{altroot}/lib/tls
158 libc.so.6* libpthread.so.0* librt.so.1
159 /{altroot}/usr/lib
160 libcrypto.so.1 libz.so.1
161
162 Ok, libraries are the truly nasty part. The set of libraries
163 depends on your specific operating system and the scponly
164 supported utilities. The above set works with RedHat Linux.
165
166 For other operating systems you probably need to run ldd on the
167 binaries you copy into bin, usr/bin, usr/libexec, etc. You may
168 also need to run ldd on the libraries to determine a complete
169 set of libraries and their required location in the chrooted
170 environment.
171
172 If things don't work suspect incomplete library selection or that
173 a library is in the wrong location.
174
175 4. Modify the top level /etc/password file. (See above for the format of
176 the chrooted etc/password file.)
177
178 The top level /etc/password file is modified for each scponly user,
179 you insert the chrooted path in front of the existing path (With
180 a // at the chroot point) and the shell set to your scponlyc location.
181
182 Original /etc/passwd line
183 auser:x:3444:3000:A user:/home/auser:/bin/csh
184 Modified /etc/passwd line
185 auser:x:3444:3000:A user:/{altroot}//home/EmptyHomeDir:/sbin/scponlyc
186
187 Where {altroot} is your chosen chroot point for this user,
188 EmptyHomeDir is the chrooted home directory name, and scponlyc is
189 the path your installed version.
190
191 The two slashes ('//') are used by scponlyc to determine the chroot
192 point. Everything in front of them is used as the new root location
193 in the chroot call. Everything after the double slash designates the
194 directory to chdir() into AFTER chrooting. This is so users can be
195 dropped into a writable directory inside the chroot.