[PREV] | [UP] | [NEXT]
Chrooted SSH
Chrooted SSH is still an experimental feature in DISC
The idea behind chrooted SSH on DISC is that it is possible to set up a
ssh chroot per hosted domain. Users with SSH access will have access
to all directories that belong to that host. Executables have to be available
within this chrooted environment.
Problems
Many features (cron!) are running globally
Every user has his/her own preferred executables, so this chroot can
make the filesystem quite big
DISC was not developed for chroot so the web directory is writable for
all users in the chroot!
Sources
We are using the chroot patch to OpenSSH. This patch can be found on http://chrootssh.sourceforge.net/ It is quite easy to patch the standard debian package
for this, too:
# cd /usr/local/src/
# wget
# cd openssh-3.8.1p1 (or your version)
# patch -p1 < ../osshChroot-3.8.1p1.diff
# debian/rules binary
# cd ..
# dpkg -i ssh_3.8.1p1-4_i386.deb
|
To create the chrooted environment we use a script called create_chroot_env, which was found in the outskirts of internet and is now part of the DISC cvs. It will be updated to reflect the needs of genuine DISC users.
Setup
Update your SSH package to support chroot. If you are using the debian
package, you need to "pin" this version so that it will not be upgraded by
accident. You do that by putting this in /etc/apt/preferences :
Package: ssh
Pin: version 3.8p1-4
Pin-Priority: 200
Run "create_chroot_environment" for each host where you want to have ssh users (this is not integrated in DISC yet).
Use phpldapadmin to set "shell" to /bin/bash and homedir to /hosting/domain/./home/user (the /./ will take care of the chroot
[PREV] | [UP] | [NEXT]