chrootssh-users — A mailing list primarily for informing users of new releases

Re: [Chrootssh-users] chroot not doing anything

[James D. <jd...@la...>]

Can you explain a little more? If it is applying the patch, and 
everything is installed correctly, you should be able to test this by 
placing a '.' in the user's home directory entry in /etc/passwd. If you 
haven't built the chroot but want to test if the patch is working, try 
logging in, you will be rejected right away with a '.' in place and you 
will log in fine without it.
-James

jb...@in... wrote:
> I am using gentoo 1.4 and I had edited my openssh 3.5 ebuild file to apply
> the chroot patch.  When I emerge it, it does apply the patch sucessfully
> but sshd doesn't seam to chroot to the home dir at all. Any ideas?
> 
> Here is the output from my emerge so I know its being patched.
> 
>>>>md5 ;-) openssh-3.5p1.tar.gz
>>>>md5 ;-) osshChroot-3.5.diff
>>>>Unpacking source...
>>>>Unpacking openssh-3.5p1.tar.gz to /var/tmp/portage/openssh-3.5_p1-r1/work
>>>>Unpacking osshChroot-3.5.diff to /var/tmp/portage/openssh-3.5_p1-r1/work
> 
> unpack osshChroot-3.5.diff: file format not recognized. Ignoring.
>  * Applying osshChroot-3.5.diff...                                        
>                             [ ok ]>>> Source unpacked.
> 
> epatch ${DISTDIR}/osshChroot-3.5.diff || die
> That is the line I used to do the patch so if it wasn't patching, it
> should die there.
> 
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by:
> The Definitive IT and Networking Event. Be There!
> NetWorld+Interop Las Vegas 2003 -- Register today!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
> _______________________________________________
> Chrootssh-users mailing list
> Chr...@li...
> https://lists.sourceforge.net/lists/listinfo/chrootssh-users
> 

-- 
James Dennis
Harvard Law School

"Not everything that counts can be counted,
and not everything that can be counted counts."

Re: [Chrootssh-users] Weird error message

[James D. <jd...@la...>]

Looks like it wants the command groups inside the chroot. Do you have 
anything specific about your environment that would require that? It's 
probably safe to put it in in case your unsure.

Mike Hill wrote:
> I've been at this for some time now and I'm getting well frustrated so
> someone please help ;o)
> I get the following message in SSH debug mode when I try to connect
> login_get_lastlog: Cannot find account for uid 505. 
> 
> When using WINSCP I get 
> Command "groups"
> failed with return code 127 and error message
> /usr/bin/groups: id: command not found.
> and then it lets me in. 
> 
> I've checked the chroot directory structure numerous times and all seems
> well. 
> 
> Thanks 
> 
> Mike 
> 
> 
> 
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Chrootssh-users mailing list
> Chr...@li...
> https://lists.sourceforge.net/lists/listinfo/chrootssh-users
> 

-- 
James Dennis
Harvard Law School

"Not everything that counts can be counted,
and not everything that can be counted counts."

Re: [Chrootssh-users] Chroot and chrootssh /./ connection closed

[Steve S. <st...@ki...>]

On Tue, 25 Mar 2003, Serghej Petrov wrote:

> I've download from http://chrootssh.sourceforge.net/ patched version of
> OpenSSH (openssh-3.5p1-chroot.tar.gz) compil and install.
> But if I chroot user in /etc/passwd (
> pippo:x:506:506::/home/pippo/./:/bin/bash )
> After autentication connection is closed by sshd server... Why? Without
> /./ in password file everything is ok.

My guess would be that you haven't set up the chroot environment with all
of the binaries and libraries it needs.  In particular, there needs to be
a copy of bash in /home/pippo/bin and any shared libraries it needs in
/home/pippo/lib.

		--Steve

       "Perhaps God gave man free will so he could choose to stop those
        who had chosen evil." <James Lileks>

[Chrootssh-users] Chroot and chrootssh /./ connection closed

[Serghej P. <sp...@ti...>]

Hello=20
I've download from http://chrootssh.sourceforge.net/ patched version of
OpenSSH (openssh-3.5p1-chroot.tar.gz) compil and install.
But if I chroot user in /etc/passwd (
pippo:x:506:506::/home/pippo/./:/bin/bash )
After autentication connection is closed by sshd server... Why? Without
/./ in password file everything is ok. =20
Please help.

Best=20

Serghej

[Chrootssh-users] chroot not doing anything

[<jb...@in...>]

I am using gentoo 1.4 and I had edited my openssh 3.5 ebuild file to apply
the chroot patch.  When I emerge it, it does apply the patch sucessfully
but sshd doesn't seam to chroot to the home dir at all. Any ideas?

Here is the output from my emerge so I know its being patched.
>>> md5 ;-) openssh-3.5p1.tar.gz
>>> md5 ;-) osshChroot-3.5.diff
>>> Unpacking source...
>>> Unpacking openssh-3.5p1.tar.gz to /var/tmp/portage/openssh-3.5_p1-r1/work
>>> Unpacking osshChroot-3.5.diff to /var/tmp/portage/openssh-3.5_p1-r1/work
unpack osshChroot-3.5.diff: file format not recognized. Ignoring.
 * Applying osshChroot-3.5.diff...                                        
                            [ ok ]>>> Source unpacked.

epatch ${DISTDIR}/osshChroot-3.5.diff || die
That is the line I used to do the patch so if it wasn't patching, it
should die there.

[Chrootssh-users] Weird error message

[Mike H. <mik...@na...>]

I've been at this for some time now and I'm getting well frustrated so
someone please help ;o)
I get the following message in SSH debug mode when I try to connect
login_get_lastlog: Cannot find account for uid 505. 

When using WINSCP I get 
Command "groups"
failed with return code 127 and error message
/usr/bin/groups: id: command not found.
and then it lets me in. 

I've checked the chroot directory structure numerous times and all seems
well. 

Thanks 

Mike 

Re: [Chrootssh-users] 3.5 issues and 3.6 release

[James D. <jd...@la...>]

This email is NOT sponsored by Etnus. This is not meant to imply I have 
any sort of opinion regarding Etnus. I'm actually quite annoyed 
Sourceforge decided to tack that on without saying Sourceforge's email 
services are sponsored by Etnus.

None of my emails have any sponsors... wow I'm annoyed by this...

-------------------------------------------------------
This SF.net email is sponsored by: Etnus, makers of TotalView, The 
debugger for complex code. Debugging C/C++ programs can leave you 
feeling lost and disoriented. TotalView can help you find your way. 
Available on major UNIX and Linux platforms. Try it free. www.etnus.com
_______________________________________________
Chrootssh-users mailing list
Chr...@li...
https://lists.sourceforge.net/lists/listinfo/chrootssh-users

[Chrootssh-users] 3.5 issues and 3.6 release

[James D. <jd...@la...>]

Hey Everyone,

It has been brought to my attention that the patch for 3.5 is not 
working quite correctly for everyone. It seems to work fine for me at 
home and here at the Law School on the testing system so I am not quite 
sure what is going on. I'm going to do an unusual thing by suggesting to 
use 3.4 until 3.6 comes out on the 17th (tentative, but likely) where I 
will contact the people having issues to have them help me test the new 
patch release.

I will be working on the patch a few days before 3.6 comes out to try 
and match the release date.

I will also be leaving my position at the Law School as my co-op session 
(I'm a student at Northeastern in Boston, hence the co-op) ends on the 
17th so expect all future email from ja...@fi... (my 
personal address).

-- 
James Dennis
Harvard Law School

"Not everything that counts can be counted,
and not everything that can be counted counts."

[Chrootssh-users] New public key for James

[James D. <jd...@la...>]

Hey everyone,

I've put up a new public key. 1024 is a bit short in key length (as we 
all should know at this point) and I had it for a while so I've switched 
to a larger keysize (4096, should be good until quantum computers come 
out an ruin modern cryptography!). Anyway, if you use pgp/gpg please 
grab the key as I'll be signing every message that goes out from 
ja...@fi... with it.

-- 
James Dennis
Harvard Law School
617-596-7272

"Not everything that counts can be counted,
and not everything that can be counted counts."

Re: [Chrootssh-users] Fwd: Setting up the chroot

[James D. <jd...@la...>]

Hey Oliver,

I have put documentation explaining how this can be done on the 
chrootssh sourceforge site. Have you checked there?

-James

Oliver Bantke wrote:
> Hi,
> 
> i'm kinda new to this kind of "user-stuff", so i already apologize in
> advance....
> 
> I think i managed to install the chroot patch for my OpenSSH Installation,
> but i can't figure out how to set up the shell/chroot for the user, like
> where
> to put the directories....so if anyone could point me into the right
> direction i would appreciate it.
> 
> Thx for your time
> 

[Chrootssh-users] Fwd: Setting up the chroot

[Oliver B. <Oli...@gm...>]

Hi,

i'm kinda new to this kind of "user-stuff", so i already apologize in
advance....

I think i managed to install the chroot patch for my OpenSSH Installation,
but i can't figure out how to set up the shell/chroot for the user, like
where
to put the directories....so if anyone could point me into the right
direction i would appreciate it.

Thx for your time

-- 
+++ GMX - Mail, Messaging & more  http://www.gmx.net +++
NEU: Mit GMX ins Internet. Rund um die Uhr für 1 ct/ Min. surfen!

[Chrootssh-users] patchs folder moved!

[James D. <jd...@la...>]

Hey everyone,

I have decided to start putting up patched tarballs in addition to the 
patchs. I have to run this by the OpenSSH people first though. This 
comes as a result of people having difficulty applying the patches and 
because I like to use the gnu patch and diff. Turns out many systems 
don't have them installed (at their loss ;) after all.

A message came into the mailing list almost immediately after I made 
this change! You guys/gals are quick!

-- 
James Dennis
Harvard Law School
"Not everything that counts can be counted,
and not everything that can be counted counts."

[Chrootssh-users] Cannot download patches

[Nico Kadel-G. <nk...@ve...>]

Folks, I just tried to download the chrootssh patches from
http://chrootssh.sourceforge.net/patches/. They seem unable to be downloaded
with Internet Exploder, I'm not sure why. I had to use lynx to get them.

The 3.5 patch seems to do the right things, but it doesn't address adding a
chroot option to the configure scripts. Would you welcome an additional
patch to do this? And if I nail down a decent chroot cage builder, would
that be helpful? I've written these before, and might be able to find time
to update them appropriately.

RE: [Chrootssh-users] Connection: /bin/ssh-dummy-shell: No such f ile or directory

[Steve S. <st...@ki...>]

On Mon, 16 Dec 2002, Dunn, Delain O wrote:

>    I created a bin dir in the user's home, and copied ssh-dummy-shell into
> it.  I ssh to the account and now I get a different messages:
>
> Last login: Thu Dec 12 2002 11:16:06 -0600 from neo
> No mail.
> ssh-dummy-shell: Cannot find /usr/lib/ld.so.1
> Connection to cronus.lmtas.lmco.com closed.
>
> And I've checked that lib dose exist, do I need to move the shell up one
> dir?

You will need a usr/lib in the chroot jail.  I also usually set up a sym
link from a lib in the chroot jail to the usr/lib that I build there.
Then you will need to copy the ld.so.1 from /usr/lib to the usr/lib in the
chroot jail.  If you have other binaries that need access in the chroot
jail, you can find out what dynamic libraries they need by using ldd.

		--Steve

       "Perhaps God gave man free will so he
       could choose to stop those who had chosen evil."
       <James Lileks>

[Chrootssh-users] Thanks!

[Herald v. d. B. <he...@br...>]

The chroot patch works great! Thanks!

I needed to copy extra and other files than mentioned in
http://chrootssh.sourceforge.net/docs/chrootedsftp.html for my system
(RedHat 8). I needed in addition /dev files (I did a "MAKEDEV -d . null
zero tty" but this is probably  more than needed) and /etc/passwd and
/etc/shadow (which I cleaned up a bit). The needed libraries were
different. I installed:

$ ls lib usr/lib
lib:
ld-linux.so.2  libattr.so.1    libc.so.6   libnsl.so.1    
libtermcap.so.2
libacl.so.1    libcrypto.so.2  libdl.so.2  libresolv.so.2  libutil.so.1

usr/lib:
libcom_err.so.3  libk5crypto.so.3  libkrb5.so.3  libz.so.1

But some of them were not required for sftp.
Now everthing works great, even for bash

Regards,
Herald

RE: [Chrootssh-users] Connection: /bin/ssh-dummy-shell: No such f ile or directory

[Dunn, D. O <del...@lm...>]

Hi Steve,
   I created a bin dir in the user's home, and copied ssh-dummy-shell into
it.  I ssh to the account and now I get a different messages: 

Last login: Thu Dec 12 2002 11:16:06 -0600 from neo
No mail.
ssh-dummy-shell: Cannot find /usr/lib/ld.so.1
Connection to cronus.lmtas.lmco.com closed.

And I've checked that lib dose exist, do I need to move the shell up one
dir?

-----Original Message-----
From: Steve Schlaifer [mailto:st...@ki...]
Sent: Sunday, December 15, 2002 6:21 PM
To: Dunn, Delain O
Cc: 'chr...@li...'; 'ja...@fi...'
Subject: Re: [Chrootssh-users] Connection: /bin/ssh-dummy-shell: No such
file or directory


On Thu, 12 Dec 2002, Dunn, Delain O wrote:

>     I hope you can help me, since I have not seen this problem posted on
the
> web anywhere.  I'm currently running SSH Secure Shell 3.2.0  on Solaris 8.
> I've successfully setup ChRootGroups so when my users sftp into the
server,
> they are not able to change directors.  But when they try to SSH into the
> server they get the following error message:
>
> Authentication successful.
> Last login: Wed Dec 11 2002 15:07:54 -0600 from neo
> No mail.
> /bin/ssh-dummy-shell: No such file or directory
> Connection to server closed.
>
>
> Any clues as to what I may be missing?  Like I said this is working fine
> with sftp, I've edited the /etc/passwd file so the user's shell is set to
> /bin/ssh-dummy-shell, and I have included the shell in /etc/shells file.

Did you put the ssh-dummy-shell inside the bin directory inside the chroot
jail area or just inside the system /bin?

		--Steve

       "Perhaps God gave man free will so he
       could choose to stop those who had chosen evil."
       <James Lileks>

Re: [Chrootssh-users] Connection: /bin/ssh-dummy-shell: No such file or directory

[Steve S. <st...@ki...>]

On Thu, 12 Dec 2002, Dunn, Delain O wrote:

>     I hope you can help me, since I have not seen this problem posted on the
> web anywhere.  I'm currently running SSH Secure Shell 3.2.0  on Solaris 8.
> I've successfully setup ChRootGroups so when my users sftp into the server,
> they are not able to change directors.  But when they try to SSH into the
> server they get the following error message:
>
> Authentication successful.
> Last login: Wed Dec 11 2002 15:07:54 -0600 from neo
> No mail.
> /bin/ssh-dummy-shell: No such file or directory
> Connection to server closed.
>
>
> Any clues as to what I may be missing?  Like I said this is working fine
> with sftp, I've edited the /etc/passwd file so the user's shell is set to
> /bin/ssh-dummy-shell, and I have included the shell in /etc/shells file.

Did you put the ssh-dummy-shell inside the bin directory inside the chroot
jail area or just inside the system /bin?

		--Steve

       "Perhaps God gave man free will so he
       could choose to stop those who had chosen evil."
       <James Lileks>

[Chrootssh-users] Connection: /bin/ssh-dummy-shell: No such file or directory

[Dunn, D. O <del...@lm...>]

Hello,
    I hope you can help me, since I have not seen this problem posted on the
web anywhere.  I'm currently running SSH Secure Shell 3.2.0  on Solaris 8.
I've successfully setup ChRootGroups so when my users sftp into the server,
they are not able to change directors.  But when they try to SSH into the
server they get the following error message:

Authentication successful.
Last login: Wed Dec 11 2002 15:07:54 -0600 from neo
No mail.
/bin/ssh-dummy-shell: No such file or directory
Connection to server closed.


Any clues as to what I may be missing?  Like I said this is working fine
with sftp, I've edited the /etc/passwd file so the user's shell is set to
/bin/ssh-dummy-shell, and I have included the shell in /etc/shells file.

Let me know your thoughts, & if you need more info.

Thanks,
Delain

[Chrootssh-users] SFTP error

[Jeremy H. <je...@so...>]

Hi,

I was going to write you about an error I've been having, but I just 
fixed it somehow so I'm just sending this to you to say thanks for the 
patch!

Jeremy Hein

-- 
"Nothing would please me more than being able to
hire ten programmers and deluge the hobby market
with good software." -- Bill Gates 1976

We are still waiting ....

[Chrootssh-users] chroot problem

[Michael W. <mi...@ne...>]

Hello,

I am using Red Hat 7.2 and tried with openssh 3.3 and openssh 3.5, but =
the results are the same. My problem is when chroot users try to login, =
they cannot. Non-chroot users are ok. Also, when i try 'chroot /chroot =
/bin/ls' it works ok.

This is what i am getting:

[root@furry root]# chroot /chroot /bin/sh
sh-2.05# ls -l
total 20
drwxr-xr-x    2 0        0            4096 Nov  7 02:27 bin
drwxr-xr-x    2 0        0            4096 Nov  7 01:15 dev
drwxr-xr-x    3 0        0            4096 Nov  7 01:17 home
drwxr-xr-x    2 0        0            4096 Nov  7 01:11 lib
drwxr-xr-x    2 0        0            4096 Nov  7 01:07 usr

(so looks like chroot is ok?)
-------------------------------------------------------------------------=

ssh root@0=20
root@0's password:=20
Last login: Thu Nov  7 13:44:02 2002 from 192.168.102.1
[root@furry root]#=20

(root could login fine)
-------------------------------------------------------------------------=
-
[root@furry root]# ssh mike@0
mike@0's password:=20
Last login: Thu Nov  7 13:23:30 2002 from 192.168.102.1

(non-chroot users could login)
-------------------------------------------------------------------------=
--
[root@furry root]# ssh mikechr@0
mikechr@0's password:=20
Connection to 0 closed by remote host.
Connection to 0 closed.

(chroot users cannot login :-(, his line from passwd:  =
mikechr:x:504:506::/chroot/./home/mikechr:/bin/sh)

I tried also to compile openssh with pam support, but nothing changes.

Any help will be appreciated!

Thanks,
Mike.

[Chrootssh-users] chroot patches

[Nico Kadel-G. <nk...@be...>]

Folks? We need to attribute patches. And the patches should include the
changes to configure.ac to include it as merely an option, because enabling
it without warning can do *oddities* with ftp installations.

In any case, you can take a look at my previous work at
http://www.merl.com/people/nkadel/. I've also got a little widget there to
build chrootable directories, suitable for generation on the fly and easily
updated for library changes.

Enjoy....

                                Nico Kadel-Garcia
                                nk...@be...

[Chrootssh-users] (no subject)

[Jose C. <ja...@co...>]

-- 
Jose Celestino <ja...@co...> SAPO.pt::Systems http://www.sapo.pt
---------------------------------------------------------------------
Quod licet Iovi non licet bovi.
(What Jove may do, is not permitted to a cow.)

[Chrootssh-users] register

[Jean-Michel P. <jm....@fr...>]

[Chrootssh-users] test

[James D. <jd...@la...>]

Just making sure this works.
-James