Re: Chrooted SFTP & logging problems To set a start directory, just set the home directory of the
chrootuser in /etc/passwd to the value it would be when the user is in
the chroot jail:
e.g:
% mkdir /export/home/chrootuser/home
% chown root:chrootuser /export/home/chrootuser/home
% chmod 770 /export/home/chrootuser/home # so chrootuser can actually
write to it
Set the homedir in /etc/passwd:
chrootuser:x:60011:1003:Test SFTP User:/home:/bin/false
One more thing. The mode on the top level of the jail in my post
before is incorrect - this should be set to 750, not 710. This means
chrootuser can go up one level and see the dev & home folders but
can't write anything except to the home folder. There may be potential
for writing to /dev/conslog in the jail and inserting duff log entries
- but they'd need to know the file was called /dev/conslog (you can't
'ls' on this to figure it's there) and also be able to write.
Potentially you could upload a file with syslog instructions in it?)
This is a possible vulnerability but this must be common to most
chroot environments which require a log device of some description. |