Re: restricting users with UID=0 does not work?

[Tomasz C. <ma...@wp...>]

On Sun, 19 Jan 2014 07:35:05 -0800
Ben Walton <bdw...@gm...> wrote:

> > I'm getting chroot for some@user when the UID is different than 0.
> > If the UID for some@user is set to 0, I'm no longer getting the
> > chroot and I'm able to browse the whole server.
> 
> What do you expect to achieve by chrooting a uid=0 account? With
> uid=0, it is easy to step out of a chroot...chroot is not a security
> mechanism.

My usage scenario is as follows:

- user rsyncs (or uses sftp) data to a chrooted environment,

- as uid=0, the user is able to keep uids/gids exactly in sync with the
  origin server.


I'm aware that it's trivial to get out of chroot if you have a root
shell, but my impression was that rssh was the tool to prevent it.
Are there any known security issues with rssh which would allow a
chrooted user with uid=0 to bypass chroot? I assume the following:

- allowscp, allowsftp, allowrsync options enabled

- chroot environment read only, except the area where the users puts
  new data


-- 
Tomasz Chmielewski
http://wpkg.org