rssh-discuss — General discussion of rssh

Re: rssh 2.2

[Derek M. <co...@pi...>]

On Thu, Jun 03, 2004 at 11:32:57AM +0200, Yves Martin wrote:
> 
>   Hello,
> 
>  I get the 2.2 version because I'm looking for a 'cvs' support in a
>  secured shell. I find it strange that 2.2 version has no official
>  home page with download, FAQ and docs. Why ? Is it a fork ?

No...  It's because a) I'm lazy, and b) it has a bug which I've fixed
and now I need to release an update.  So I never bothered to update
the website, etc.

I'll release 2.2.1 this weekend, I guess.

>  Except that details, I was able to create my chroot jail (manually)
>  and use cvs - with that trouble:
> 
>  In commit, cvs used "uid753" instead of "testcvs". I does not look
>  good in cvs log.
>  Same issue, scp refuse to work: unknown user 753
> 
>  I have correctly copied /etc/nsswitch.conf, passwd and group in my
>  jail - BUT libnss_files lacks and it is impossible to find out except
>  with a
>     strace chroot /myjail getent passwd testcvs
>  run as root. That library is not refered by ldd ! So take care.

If I understand you correctly, the problem was you didn't copy
libnss_files.* to your jail.  You're right that ldd won't show this
library.  However the CHROOT file specifically mentions this issue...
mkchroot.sh also warns about it.

>  I found a bug when reading the mkchroot.sh script:
>   replace /usr/bin/scp by $prog in ldd command:
> 
> for prog in $scp_path $sftp_server_path $rssh_path $chroot_helper_path; do
> 	echo "Copying libraries for $prog."
> 	libs=`ldd /usr/bin/scp | tr -s ' ' | cut -d' ' -f3`

Thanks, fixed.  :)

>  Another point: if I do
>     ./configure --with-scp /bin/scp --with-cvs /bin/cvs
>  I expect the code to use that paths and not autodetected /usr/bin/scp
>  and /usr/bin/cvs from my PATH instead of my options.

It would, if you did it correctly.  You need to use the equal sign:

  --with-scp=/bin/scp

>  Thank you for your job on that must-have tool !

You're welcome!  :)

-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

rssh 2.2

[Yves M. <yve...@el...>]

  Hello,

 I get the 2.2 version because I'm looking for a 'cvs' support in a
 secured shell. I find it strange that 2.2 version has no official
 home page with download, FAQ and docs. Why ? Is it a fork ?

 Except that details, I was able to create my chroot jail (manually)
 and use cvs - with that trouble:

 In commit, cvs used "uid753" instead of "testcvs". I does not look
 good in cvs log.
 Same issue, scp refuse to work: unknown user 753

 I have correctly copied /etc/nsswitch.conf, passwd and group in my
 jail - BUT libnss_files lacks and it is impossible to find out except
 with a
    strace chroot /myjail getent passwd testcvs
 run as root. That library is not refered by ldd ! So take care.


 I found a bug when reading the mkchroot.sh script:
  replace /usr/bin/scp by $prog in ldd command:

for prog in $scp_path $sftp_server_path $rssh_path $chroot_helper_path; do
	echo "Copying libraries for $prog."
	libs=`ldd /usr/bin/scp | tr -s ' ' | cut -d' ' -f3`


 Another point: if I do
    ./configure --with-scp /bin/scp --with-cvs /bin/cvs
 I expect the code to use that paths and not autodetected /usr/bin/scp
 and /usr/bin/cvs from my PATH instead of my options.


 Thank you for your job on that must-have tool !
-- 
Yves Martin

Re: rssh ignores some access bits

[Derek M. <co...@pi...>]

On Mon, May 24, 2004 at 11:56:12PM -0700, rss...@as... wrote:
> Consider the following line in /etc/rssh.conf:
> 
>         user = test:002:11111:
> 
> If I read the documentation correctly, test should be able to rsync,
> rdist, cvs, sftp and scp.   However only sftp and scp seem to be
> honored:

Oops...  I meant to include the patch for this in my last post.  Here
it is:

--- rsshconf.c  2004-05-23 15:27:43.000000000 +0900
+++ rsshconf.c.fixed    2004-05-23 15:23:10.000000000 +0900
@@ -919,6 +919,18 @@
                log_msg("allowing sftp to user %s", user);
                opts->shell_flags |= RSSH_ALLOW_SFTP;
        }
+       if ( allow_cvs ){
+               log_msg("allowing cvs to user %s", user);
+               opts->shell_flags |= RSSH_ALLOW_CVS;
+       }
+       if ( allow_rdist ){
+               log_msg("allowing rdist to user %s", user);
+               opts->shell_flags |= RSSH_ALLOW_RDIST;
+       }
+       if ( allow_rsync ){
+               log_msg("allowing rsync to user %s", user);
+               opts->shell_flags |= RSSH_ALLOW_RSYNC;
+       }
        if ( path ){
                log_msg("chrooting %s to %s", user, path);
                opts->shell_flags |= RSSH_USE_CHROOT;

-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

Re: patch to fix rssh_chroot_helper location

[Derek M. <co...@pi...>]

On Mon, May 24, 2004 at 11:45:14PM -0700, rss...@as... wrote:
> The source, by default in v2.2.0, installs the rssh_chroot_helper
> in /usr/local/libexec/rssh_chroot_helper.  However the pathname.h
> file that is built by configure has PATH_CHROOT_HELPER hard coded
> to /usr/local/bin/rssh_chroot_helper.

Look again; it only does that if it isn't already defined.  If you run
configure appropriately, it will be defined...

> It would be nice if pathname.h honored the --prefix config
> convention.

It does.  But --prefix doesn't set the location of libexec files...
I suggest you read the output of configure --help.  Hint: you're
looking for --exec-prefix.  :)

  $ rpm -ql rssh
  /etc/rssh.conf
  /usr/bin/rssh
  /usr/libexec/rssh_chroot_helper
  [...]

> The following patch will cause pathname.h to be built
> with PATH_CHROOT_HELPER set under a libexec sub-directory.

Thanks, but no thanks.  If you run configure properly, it already does
that.  I think the issue here is that recent versions of
autoconf/automake have changed the behavior of the configure script,
and people are just not yet aware/accustomed to the change.  Maybe
I'll add this to the INSTALL file...


On Mon, May 24, 2004 at 11:56:12PM -0700, rss...@as... wrote:
> Consider the following line in /etc/rssh.conf:
> 
>         user = test:002:11111:

Yes, I am aware of this problem, and in fact it's already fixed.  I
just need to re-release the code, which I will probably do this
weekend.  I've been really strapped for spare time lately.  Real life
intrudes...  Check the website on Saturday for a release.  Or look in
the source and add the necessary 6 lines yourself...  ;-)  I'm not
sure how I managed to release the code without them, but nobody's
perfect...  Sigh.

Thanks for bringing these issues up, though.  Free software works
well because people work together to make it work well.

-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

rssh ignores some access bits

[<rss...@as...>]

Consider the following line in /etc/rssh.conf:

        user = test:002:11111:

If I read the documentation correctly, test should be able to rsync,
rdist, cvs, sftp and scp.   However only sftp and scp seem to be
honored:

    May 24 23:28:18 hostname rssh[17811]: setting log facility to LOG_USER
    May 24 23:28:18 hostname rssh[17811]: setting umask to 022
    May 24 23:28:18 hostname rssh[17811]: line 50: configuring user test
    May 24 23:28:18 hostname rssh[17811]: setting test's umask to 02
    May 24 23:28:18 hostname rssh[17811]: allowing scp to user test
    May 24 23:28:18 hostname rssh[17811]: allowing sftp to user test

If I comment OUT / remove the "user = test:002:11111:" line, and
comment IN / enable all 5 global allow* lines:

    allowscp
    allowsftp
    allowcvs
    allowrdist
    allowrsync

    ...

    #user = test:002:11111:

I get:

    May 25 00:00:36 hostname rssh[18139]: setting log facility to LOG_USER
    May 25 00:00:36 hostname rssh[18139]: allowing scp to all users
    May 25 00:00:36 hostname rssh[18139]: allowing sftp to all users
    May 25 00:00:36 hostname rssh[18139]: allowing cvs to all users
    May 25 00:00:36 hostname rssh[18139]: allowing rdist to all users
    May 25 00:00:36 hostname rssh[18139]: allowing rsync to all users
    May 25 00:00:36 hostname rssh[18139]: setting umask to 022

A test of rsync shows that it works when the global 'allowrsync' is set
and the user line is commented out.  However rsync fails with the '11111'
access bits for a particular user is used.

I am using the rssh v2.2.0 source tarball on RHEL3.

chongo (http://www.isthe.com/chongo/index.html) /\oo/\

patch to fix rssh_chroot_helper location

[<rss...@as...>]

The source, by default in v2.2.0, installs the rssh_chroot_helper
in /usr/local/libexec/rssh_chroot_helper.  However the pathname.h
file that is built by configure has PATH_CHROOT_HELPER hard coded
to /usr/local/bin/rssh_chroot_helper.

It would be nice if pathname.h honored the --prefix config convention.
It is reasonable to place rssh_chroot_helper under libexec somewhere.

The following patch will cause pathname.h to be built
with PATH_CHROOT_HELPER set under a libexec sub-directory.

By default (without using --prefix) the PATH_CHROOT_HELPER is
/usr/local/libexec/rssh_chroot_helper (which is where the Makefile
actually installs rssh_chroot_helper now).  The --prefix value is
now honored.  For example, if one does:

        ./configure --prefix=/usr

then PATH_CHROOT_HELPER in pathname.h becomes:

        /usr/libexec/rssh_chroot_helper

--- pathnames.h.in.init 2003-08-08 14:49:28.000000000 -0700
+++ pathnames.h.in      2004-05-24 23:20:34.000000000 -0700
@@ -43,7 +43,7 @@
 #endif /* PATH_RSSH_CONFIG */

 #ifndef PATH_CHROOT_HELPER
-#define PATH_CHROOT_HELPER     "/usr/local/bin/rssh_chroot_helper"
+#define PATH_CHROOT_HELPER     "@prefix@/libexec/rssh_chroot_helper"
 #endif /* PATH_CHROOT_HELPER */

 #endif /* _rssh_pathnames_h */

chongo (http://www.isthe.com/chongo/index.html) /\oo/\

Re: Problem with use rssh

[Derek M. <co...@pi...>]

On Sun, Apr 04, 2004 at 07:58:55PM +0200, Lukasz Piskorz wrote:
> Hi,
>=20
> Thanks a lot for your help. My rssh shell still doesn't work.

Ok, let's see what we can do.

> I copied all files and direcotires from /lib and /usr/lib/ in order to be
> sure that no one file is missing.  According to your tip I checked:
> #ldd `which sftp`

Looks like you have all the libraries.  That's good.  But the problem
with copying everything is that now, if I want to see the contents of
your jail to look at what might be missing, I would have to look at a
whole lot of irrelevant files.  And of course, they do take up space
on your hard drive...

> My problem is still the same. I can't login to system with rssh.
> I write again:
> Use sftp with debug option.

The debug output to sftp is really not helpful.  We already know the
problem is with your installation of rssh, not with sftp.

> May I ask you again? How can I solve this problem? If you want more
> information about my system write to me.

Please post your complete rssh.conf file, any related log messages
=66rom a failed access attempt, and the contents of the etc directory
*INSIDE the chroot jail*.  I'll look, but I can't make promises.  As I
say in all the documentation, I don't really support setting up chroot
jails, because it's complicated and system-dependent.

--=20
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

Re: Problem with use rssh

[Lukasz P. <lpi...@is...>]

Hi,

Thanks a lot for your help. My rssh shell still doesn't work.

>> I try to compile, configure and use rssh. I read CHROOT files and
>> configure my system.
>
>Well, you have at least one obvious (to me) mistake.  Depending on
>what distro you have, there may be others.

I use Linux Debian woody with kernel 2.2.

>> I configure /usr/local/etc/rssh file
>> What do I change?
>> 1. Uncommented
>> allowscp
>> allowsftp
>> 2. Change line:
>> chrootpath="/usr/sbin/chroot /usr/chroot/"
>
>This is wrong.  The chrootpath line should contain ONLY the path to
>the directory you will use as your chroot jail.  You have the path to
>the chroot binary here.  The chroot binary is 100% irrelevant to rssh.
>
>With what you have, rssh is trying to chroot to the directory
>"/usr/sbin/chroot /usr/chroot/", which almost certainly doesn't exist.
>Based on what you wrote after this, it should read as follows:
>
>  chrootpath="/usr/chroot/"

I corrected my mistake.
   chrootpath="/usr/chroot/"

>> 1. Create new user test. In /etc/passwd I have line:
>> test:x:1010:1010:,,,:/usr/chroot:/usr/local/bin/rssh
>> 2. mkdir /usr/chroot
>> 3. mkdir /usr/chroot/lib /usr/chroot/etc/ /usr/chroot/local/bin/
>> 4. cp -r /lib/* /usr/chroot/
>> 5. cp /usr/bin/scp /usr/chroot/usr/bin/scp
>> 6. cp /usr/bin/sftp-server /usr/chroot/usr/bin/sftp-server
>> 7. cp /usr/local/bin/rssh /usr/chroot/usr/local/bin/rssh
>> 8. cp /usr/local/etc/rssh /usr/chroot/usr/local/etc/rssh
>> 9. cp /etc/ld* /usr/chroot/etc/
>> 10. cp /etc/passwd /usr/chroot/etc/
>> 11. cp -r /etc/ssh* /usr/chroot/
>> 12. cp /usr/lib/lib* /usr/chroot/usr/lib/
>
>If you're using Red Hat, I'm pretty sure there's at least one
>necessary library which is not in either /lib or /usr/lib.  Be sure to
>use the ldd command, as mentioned in the CHROOT file, to figure out
>exactly what libraries you need.

I copied all files and direcotires from /lib and /usr/lib/ in order to be
sure that no one file is missing.
According to your tip I checked:
#ldd `which sftp`
debian:/usr/chroot# ldd `which sftp`
                libutil.so.1 => /lib/libutil.so.1 (0x4001c000)
        libz.so.1 => /lib/libz.so.1 (0x4001f000)
        libnsl.so.1 => /lib/libnsl.so.1 (0x4002c000)
        libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x40040000)
        libc.so.6 => /lib/libc.so.6 (0x400fa000)
        libdl.so.2 => /lib/libdl.so.2 (0x4022a000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

and
#ldd `which scp`
                libutil.so.1 => /lib/libutil.so.1 (0x4001c000)
        libz.so.1 => /lib/libz.so.1 (0x4001f000)
        libnsl.so.1 => /lib/libnsl.so.1 (0x4002c000)
        libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x40040000)
        libc.so.6 => /lib/libc.so.6 (0x400fa000)
        libdl.so.2 => /lib/libdl.so.2 (0x4022a000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

All files from the list above are in chrootpath /usr/chroot/...

My problem is still the same. I can't login to system with rssh.
I write again:
Use sftp with debug option.

#sftp -v test@192.168.1.1
Connecting to 192.168.1.1...
OpenSSH_3.4p1 Debian 1:3.4p1-1.woody.3, SSH protocols 1.5/2.0, OpenSSL
0x0090603f
[...]
debug1: next auth method to try is password
test@192.168.1.1's password: xxxxx

debug1: ssh-userauth2 successful: method password
debug1: fd 4 setting O_NONBLOCK
debug1: channel 0: new [client-session]
debug1: send channel open 0
debug1: Entering interactive session.
debug1: ssh_session2_setup: id 0
debug1: Sending subsystem: sftp
debug1: channel request 0: subsystem
debug1: channel 0: open confirm rwindow 10000 rmax 32768
debug1: client_input_channel_req: channel 0 rtype exit-signal reply 0
debug1: channel 0: rcvd close
debug1: channel 0: output open -> drain
debug1: channel 0: close_read
debug1: channel 0: input open -> closed
debug1: channel 0: obuf empty
debug1: channel 0: close_write
debug1: channel 0: output drain -> closed
debug1: channel 0: almost dead
debug1: channel 0: gc: notify user
debug1: channel 0: gc: user detached
debug1: channel 0: send close
debug1: channel 0: is dead
debug1: channel 0: garbage collecting
debug1: channel_free: channel 0: client-session, nchannels 1
debug1: fd 0 clearing O_NONBLOCK
debug1: Transferred: stdin 0, stdout 0, stderr 0 bytes in 0.0 seconds
debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 0.0
debug1: Exit status -1
Connection closed
#

May I ask you again? How can I solve this problem? If you want more
information about my system write to me.

Luke

Re: Problem with use rssh

[Derek M. <co...@pi...>]

On Fri, Apr 02, 2004 at 12:21:47PM +0200, lpi...@ka... wrote:
> Hi all,

Hi!

> I try to compile, configure and use rssh. I read CHROOT files and
> configure my system.

Well, you have at least one obvious (to me) mistake.  Depending on
what distro you have, there may be others.

> I configure /usr/local/etc/rssh file
> What do I change?
> 1. Uncommented
> allowscp
> allowsftp
> 2. Change line:
> chrootpath="/usr/sbin/chroot /usr/chroot/"

This is wrong.  The chrootpath line should contain ONLY the path to
the directory you will use as your chroot jail.  You have the path to
the chroot binary here.  The chroot binary is 100% irrelevant to rssh.

With what you have, rssh is trying to chroot to the directory
"/usr/sbin/chroot /usr/chroot/", which almost certainly doesn't exist.
Based on what you wrote after this, it should read as follows:

  chrootpath="/usr/chroot/"

> 1. Create new user test. In /etc/passwd I have line:
> test:x:1010:1010:,,,:/usr/chroot:/usr/local/bin/rssh
> 2. mkdir /usr/chroot
> 3. mkdir /usr/chroot/lib /usr/chroot/etc/ /usr/chroot/local/bin/
> 4. cp -r /lib/* /usr/chroot/
> 5. cp /usr/bin/scp /usr/chroot/usr/bin/scp
> 6. cp /usr/bin/sftp-server /usr/chroot/usr/bin/sftp-server
> 7. cp /usr/local/bin/rssh /usr/chroot/usr/local/bin/rssh
> 8. cp /usr/local/etc/rssh /usr/chroot/usr/local/etc/rssh
> 9. cp /etc/ld* /usr/chroot/etc/
> 10. cp /etc/passwd /usr/chroot/etc/
> 11. cp -r /etc/ssh* /usr/chroot/
> 12. cp /usr/lib/lib* /usr/chroot/usr/lib/

If you're using Red Hat, I'm pretty sure there's at least one
necessary library which is not in either /lib or /usr/lib.  Be sure to
use the ldd command, as mentioned in the CHROOT file, to figure out
exactly what libraries you need.

Also, your step #11 should be unnecessary.  SSHD reads the files it
needs in /etc/ssh long before rssh gets involved.

Derek

-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

Problem with use rssh

[<lpi...@ka...>]

Hi all,

I'm new in this group but welcome everybody.

I try to compile, configure and use rssh. I read CHROOT files and
configure my system.

When I try to use sftp from other system I see message:

debian:~# sftp test@192.168.1.1
Connecting to 192.168.1.1...
test@192.168.1.1's password:
Connection closed
debian:~#

I couldn't login to debian system.

Could you help me and tell me what I did wrong?

When I configured system (after read CHROOT file) I did

I configure /usr/local/etc/rssh file
What do I change?
1. Uncommented
allowscp
allowsftp
2. Change line:
chrootpath="/usr/sbin/chroot /usr/chroot/"


1. Create new user test. In /etc/passwd I have line:
test:x:1010:1010:,,,:/usr/chroot:/usr/local/bin/rssh
2. mkdir /usr/chroot
3. mkdir /usr/chroot/lib /usr/chroot/etc/ /usr/chroot/local/bin/
4. cp -r /lib/* /usr/chroot/
5. cp /usr/bin/scp /usr/chroot/usr/bin/scp
6. cp /usr/bin/sftp-server /usr/chroot/usr/bin/sftp-server
7. cp /usr/local/bin/rssh /usr/chroot/usr/local/bin/rssh
8. cp /usr/local/etc/rssh /usr/chroot/usr/local/etc/rssh
9. cp /etc/ld* /usr/chroot/etc/
10. cp /etc/passwd /usr/chroot/etc/
11. cp -r /etc/ssh* /usr/chroot/
12. cp /usr/lib/lib* /usr/chroot/usr/lib/
And all,

Re: rssh - sftp-server and forbidden commands

[Derek M. <co...@pi...>]

On Tue, Jan 06, 2004 at 07:21:18PM +0000, Monchanin Eric wrote:
> Hi there, I browsed a little on the web, and on the archives of this
> mailing list ... but couldn't find my answer, so here is my problem
[SNIP]
> when I try to connect using sftp, I got a:
>=20
> Jan  6 11:37:12 galadriel sshd(pam_unix)[14340]: session opened for user
> test2 by (uid=3D506)
> Jan  6 11:37:12 galadriel rssh[14341]: setting log facility to LOG_USER
> Jan  6 11:37:12 galadriel rssh[14341]: allowing scp to all users
> Jan  6 11:37:12 galadriel rssh[14341]: allowing sftp to all users
> Jan  6 11:37:12 galadriel rssh[14341]: line 34: configuring user test2
> Jan  6 11:37:12 galadriel rssh[14341]: setting test2's umask to 077
> Jan  6 11:37:12 galadriel rssh[14341]: allowing scp to user test2
> Jan  6 11:37:12 galadriel rssh[14341]: allowing sftp to user test2
> Jan  6 11:37:12 galadriel rssh[14341]: user test2 attempted to execute
> forbidden commands
> Jan  6 11:37:12 skycore1 rssh[14341]: command:
> /usr/libexec/openssh/sftp-server
> Jan  6 11:37:13 skycore1 sshd(pam_unix)[14340]: session closed for user t=
est2
>=20
> I don't know what to do, so if you have any idea ...

Well the only thing that comes to mind is that rssh thinks
/usr/libexec/openssh/sftp-server is a forbidden command, so when you
ran configure, you may have configured the sftp-server binary to be in
a different location.  Possibly, you have two versions of SSH
installed, and the configure script picked up the sftp-server binary
=66rom the wrong one.  Other than that, maybe you could send the output
=66rom ./configure to help diagnose the problem.

That is, if this still is a problem...  Sorry about the long response
time.

--=20
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

Re: Redhat 8, RSSH and chroot jail

[Derek M. <co...@pi...>]

On Fri, Nov 21, 2003 at 10:50:55AM -0500, Anthony Rabaa wrote:
> Hello,
> 
> I've been fiddling with rssh and jailed sftp access for over a day and 
> I'm stumped trying to figure out why my test login can successfully log 
> in just to be bumped back out.  I'm probably missing something obvious 
> and hopefully somebody may be able to point out my problem.  There are 
> two flavours I'm installing this on; Redhat 8 and another derived from 
> Debian.  The Debian system was simple to setup, jail working an all.  
> Not so good for Redhat though.

Sorry, I seem to have missed this message the first time around.  Did
you get it working?

-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

Problem compiling in AIX 5.1

[Greg C. <Gre...@we...>]

We are trying to compile rssh 2.1.0. We are running AIX 5.1 and gcc is
version 2.9-aix51-020209. We seem to run into a problem though, and we
cannot finish:

> make
make all-am
gcc -c -DHAVE_CONFIG_H -DPATH_RSSH_CONFIG=3D\"/usr/local/etc/rssh.conf\"
-DPATH_CHROOT_HELPER=3D\"/usr/local/libexec/rssh_chroot_helper\" -g -O2
rsshconf.c
In file included from
/usr/bin/../lib/gcc-lib/powerpc-ibm-aix4.3.3.0/2.9-aix51-020209/include/
sys/signal.h:349,
from /usr/include/signal.h:20,
from rsshconf.c:49:
/usr/include/sys/context.h:155: parse error before `sigset64_t'
/usr/include/sys/context.h:155: warning: no semicolon at end of struct
or union
/usr/include/sys/context.h:158: parse error before `}'
make: 1254-004 The error code from the last command is 1.


Stop.
make: 1254-004 The error code from the last command is 2.

Has anyone else seen this error? If so, any know way to fix it?

Thanks in advance.

Re: using rssh for rsync

[Derek M. <co...@pi...>]

On Fri, Mar 12, 2004 at 10:59:08PM +0000, Enrico Weigelt wrote:
> 
> Hi folks,
> 
> is there a way to use rssh for rsync ? 

Well, sort of... I was working on an update to rssh which allowed
this, but I never released it because I hadn't gotten around to
testing the rsync, rdist, and cvs support thoroughly.  Unfortunately,
before I got to do that, I had a catastrophic problem which caused me
to lose access to my source tree...  I had to re-format my laptop's
hard drive, but the back-up I did of my home directory failed.  

I had two other back-ups of the code.  One was on my other laptop,
which simultaneously developed a hardware problem, making it unusable.
The third copy is sitting on a computer in my parents' basement,
litterally half way around the world from where I am right now.  I
won't have access to that machine again until December.

So in short, it does... but not usefully.  The code to do so won't be
publicly available until a) I get access to the data from one of the
two remaining machines where it lives, b) I get bored enough to
download a copy of the source from SF and re-write the changes, or c)
until someone else does it...

FWIW, the code necessary to make it work is pretty easy to add.  But
these days I'm extrememly busy, so I don't have much time to spend on
it.  My priorities are elsewhere...


-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

using rssh for rsync

[Enrico W. <we...@me...>]

Hi folks,

is there a way to use rssh for rsync ? 


cu
-- 
---------------------------------------------------------------------
 Enrico Weigelt    ==   metux IT services

  phone:     +49 36207 519931         www:       http://www.metux.de/
  fax:       +49 36207 519932         email:     co...@me...
  cellphone: +49 174 7066481
---------------------------------------------------------------------
   -- DSL-Zugang ab 0 Euro. -- statische IP -- UUCP -- Hosting --
---------------------------------------------------------------------

Re: "Connection closed" problem

[Derek M. <co...@pi...>]

On Mon, Dec 22, 2003 at 03:00:23PM +0000, Laura Rossi wrote:
> Hi!

Hi Laura,

Sorry to take so long getting back to you.  I've moved across the
world and have only had limited Internet access up to now...

> I'm a new user of rssh and I've just set up a chroot jail for one user on 
> RedHat 7.3.

You're aware that Red Hat 7.3 is EOL and unsupported (as are all other
releases up to Red Hat 8, with RH9 soon to follow in April).  I
believe there are already known security holes in RH 7.3 which Red Hat
will not fix.  Spending time setting up chroot jails may be a waste of
your time...


> I've create the following directories and copy the files (as
> described in 
> CHROOT file):
> 
>       /usr/chroot/

[SNIP]

So it seems that you want the chroot jail to be located in
/usr/chroot, right?

> my rssh.conf is:
> 
>        logfacility = LOG_USER # you can use comments at end of line
>        allowsftp
>        umask = 022
>        chrootpath=/usr/chroot/
>        user=my_user:011:10:/usr/chroot/home/my_user

Well, then that's the problem.  You told rssh that the base of the
chroot jail for "my_user" is /usr/chroot/home/my_user, NOT
/usr/chroot.  I suggest you have another look at the man page for
rssh.conf, if this is still a problem for you.  Note particularly the
documentation about the "user=" directive.

I didn't see anything else wrong, but if you still have problems after
you fix the user= line, you may have missed a library somewhere.

-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

Re: sftp upload only

[Derek M. <co...@pi...>]

On Wed, Jan 28, 2004 at 11:26:02AM +0100, Francisco Peralta Aguaron wrote:
> maybe somebody can help me..
> I#m looking for a solution to implement somehow an upload only space
> with sftp or scp, where different users should be able to upload files 
> on a directory but not being able to delete things from (maybe there
> is some option not mentioned in the manual of rssh.conf where i can
> disable the deletion of a file?) because aproaching this problem only
> with chmod seems rather difficult.. ;)

I'm sorry, but this is simply not possible with any existing
implementation of SSH.  You'd have to re-write the clients to disallow
copying from the remote host.  I suspect this would be a difficult
task.

Or, well, it might be possible to implement that feature in rssh, but
I have no intention of doing it...  I'm basically done working on this
thing.  There are a few unresolved issues with it, which I may get
around to dealing with eventually.

Basically, I don't have a lot of time to deal with this these days.
I've moved to South Korea, where I teach English, and I've only just
gotten my Internet connection after having been here for 5 months.
I've also lost my CVS repository for rssh, though I can probably
recover that with a little effort, or I could start another from the
source tarball.  My motivation level to work on rssh these days is
extremely low...

In fact, if someone would like to take over maintaining it, I'd be
happy to give it up.

I sent someone on this list a tarball for rssh 2.1.2, which contains a
small fix for using rssh with certain clients, as well as support for
cvs and rsync/rdist.  If that person it still tuned in, and still has
that tarball, I'd greatly appreciate it if they would send it to me.

Thanks


-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

sftp upload only

[Francisco P. A. <fra...@di...>]

maybe somebody can help me..
I#m looking for a solution to implement somehow an upload only space
with sftp or scp, where different users should be able to upload files 
on a directory but not being able to delete things from (maybe there
is some option not mentioned in the manual of rssh.conf where i can
disable the deletion of a file?) because aproaching this problem only
with chmod seems rather difficult.. ;)

thanks,
Francisco:wq
-- 
Dr. Francisco Peralta Aguaron              SysAdmin DSY.it
Dipartimento di Scienze dell'Informazione   Forum Studenti
fra...@di...                        te...@ds...
http://www.10t8or.com                    http://www.dsy.it
PGP-FP: BE5C 0DCA DDB2 3729 B348  4FF3 3BD6 BD7A 1AD6 FA95

SFTP clients not sending sftp-server fill path

[MegaZone <meg...@me...>]

I believe I'm running into the same issue covered in this email from
last August:
---cut---
 > Sep  1 22:34:56 unreal rssh[21732]: allowing sftp to user sftptest
 > Sep  1 22:34:56 unreal rssh[21732]: user sftptest attempted to
 > execute forbidden commands
 > Sep  1 22:34:56 unreal rssh[21732]: command: sftp-server
 
 This is because rssh is expecting the sftp client to pass it the full
 path to the sftp-server.  What are you using on the client side?  If
 you're using the OpenSSH sftp client, it SHOULD do that.  But I guess
 there's no guarantee...
 
 I have run into this problem with certain clients, and I have fixed
 this in 2.1.2, which I haven't released yet.  I believe it's ready
 for
 release, but the reason I haven't released it yet is because I added
 code to allow cvs, rsync, and rdist, which I have not had time to
 test.
---cut---

My log:

Jan 19 15:39:37 techsrvc rssh[4791]: user sftptest attempted to
execute forbidden commands
Jan 19 15:39:37 techsrvc rssh[4791]: command: sftpserv
Jan 19 15:39:39 techsrvc sshd(pam_unix)[4790]: session closed for user
sftptest

The server is Red Hat 8.0 with OpenSSH 3.4p1 with rssh 2.1.1 installed
from RPM.  The client is FreeBSD 4.8-Stable with OpenSSH 3.5p1 and
sftp 0.9.7.  It looks like the sftp client is just sending 'sftpserv'.

The real parh on my RH8 box is - /usr/libexec/openssh/sftp-server

It does seem to be working OK from SecureFX on WinXP and from another
RH8.0 box.  So it would appear to be the client on FreeBSD.

-MZ, RHCE #806199299900541, ex-CISSP #3762
-- 
<URL:mailto:megazoneatmegazone.org> Gweep, Discordian, Author, Engineer, me.
"A little nonsense now and then, is relished by the wisest men" 508-755-4098
<URL:http://www.megazone.org/>  <URL:http://www.eyrie-productions.com/> Eris

rssh - sftp-server and forbidden commands

[Monchanin E. <emo...@sk...>]

Hi there, I browsed a little on the web, and on the archives of this
mailing list ... but couldn't find my answer, so here is my problem

I install rssh on a server and tried to configure a scp and sftp access
for some users

here is one of them:

test2:x:506:100::/home/test2:/usr/bin/rssh

my rssh.conf looks like that:

****
logfacility = LOG_USER
allowscp
allowsftp
user=test2:077:11:"/home/test"
****

where /home/test is my chroot directory

when I try to connect using sftp, I got a:

Jan  6 11:37:12 galadriel sshd(pam_unix)[14340]: session opened for user
test2 by (uid=506)
Jan  6 11:37:12 galadriel rssh[14341]: setting log facility to LOG_USER
Jan  6 11:37:12 galadriel rssh[14341]: allowing scp to all users
Jan  6 11:37:12 galadriel rssh[14341]: allowing sftp to all users
Jan  6 11:37:12 galadriel rssh[14341]: line 34: configuring user test2
Jan  6 11:37:12 galadriel rssh[14341]: setting test2's umask to 077
Jan  6 11:37:12 galadriel rssh[14341]: allowing scp to user test2
Jan  6 11:37:12 galadriel rssh[14341]: allowing sftp to user test2
Jan  6 11:37:12 galadriel rssh[14341]: user test2 attempted to execute
forbidden commands
Jan  6 11:37:12 skycore1 rssh[14341]: command:
/usr/libexec/openssh/sftp-server
Jan  6 11:37:13 skycore1 sshd(pam_unix)[14340]: session closed for user test2

I don't know what to do, so if you have any idea ...

thanks a lot

"Connection closed" problem

[Laura R. <ar...@ho...>]

Hi!
I'm a new user of rssh and I've just set up a chroot jail for one user on 
RedHat 7.3.
I've create the following directories and copy the files (as described in 
CHROOT file):

       /usr/chroot/
       /usr/chroot/usr/bin/scp
       /usr/chroot/usr/libexec/openssh/sftp-server
       /usr/chroot/usr/local/bin/rssh_chrrot_helper

copied in /usr/chroot/lib :

        /lib/libresolv.so.2
        /lib/libutil.so.1
        /lib/libnsl.so.1
        /lib/libcrypto.so.2
        /lib/i686/libc.so.6
        /lib/libdl.so.2
        /lib/ld-linux.so.2

copied in /usr/chroot/usr/lib :

        /usr/lib/libz.so.1

and then I've created :

        /usr/chroot/home/my_user

my rssh.conf is:

        logfacility = LOG_USER # you can use comments at end of line
        allowsftp
        umask = 022
        chrootpath=/usr/chroot/
        user=my_user:011:10:/usr/chroot/home/my_user

in my file passwd there is:

       my_user:x:501:0::/usr/chroot/home/my_user:/usr/bin/rssh

There is passphrase to connect and then I received the message:

      Connection closed

Verbose mode stamps this messages:

Connecting to 192.168.X.X...
OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Rhosts Authentication disabled, originating port will not be 
trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 0 geteuid 0 anon 1
debug1: Connecting to 192.168.0.150 [192.168.0.150] port 22.
debug1: temporarily_use_uid: 0/0 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 0/0 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug3: Not a RSA1 key file /root/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: no key found
debug2: key_type_from_name: unknown key type 'Proc-Type:'
debug3: key_read: no key found
debug2: key_type_from_name: unknown key type 'DEK-Info:'
debug3: key_read: no key found
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: no key found
debug1: identity file /user1/.ssh/id_rsa type 1
debug1: identity file /user1/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_3.1p1
debug1: match: OpenSSH_3.1p1 pat OpenSSH*
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: 
diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: 
aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: 
aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: 
hmac-md5,hmac-sha1,hmac-ripemd160,hma...@op...,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: 
hmac-md5,hmac-sha1,hmac-ripemd160,hma...@op...,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: 
diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: 
aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: 
aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: 
hmac-md5,hmac-sha1,hmac-ripemd160,hma...@op...,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: 
hmac-md5,hmac-sha1,hmac-ripemd160,hma...@op...,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_init: found hmac-md5
debug1: kex: server->client aes128-cbc hmac-md5 none
debug2: mac_init: found hmac-md5
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: dh_gen_key: priv key bits set: 133/256
debug1: bits set: 1581/3191
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: check_host_in_hostfile: filename /root/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 3
debug1: Host '192.168.X.X' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:3
debug1: bits set: 1594/3191
debug1: ssh_rsa_verify: signature correct
debug1: kex_derive_keys
debug1: newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: waiting for SSH2_MSG_NEWKEYS
debug1: newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: done: ssh_kex2.
debug1: send SSH2_MSG_SERVICE_REQUEST
debug1: service_accept: ssh-userauth
debug1: got SSH2_MSG_SERVICE_ACCEPT
debug1: authentications that can continue: publickey,keyboard-interactive
debug3: start over, passed a different list publickey,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: next auth method to try is publickey
debug1: try pubkey: /user1/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: input_userauth_pk_ok: pkalg ssh-rsa blen 149 lastkey 0x808fe48 hint 
0
debug2: input_userauth_pk_ok: fp 
05:c2:14:8a:7f:87:29:de:6d:54:35:a0:39:ae:e4:df
debug3: sign_and_send_pubkey
debug1: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>
Enter passphrase for key '/user1/.ssh/id_rsa':
debug1: read PEM private key done: type RSA
debug1: ssh-userauth2 successful: method publickey
debug3: clear hostkey 0
debug3: clear hostkey 1
debug3: clear hostkey 2
debug1: fd 4 setting O_NONBLOCK
debug2: fd 5 is O_NONBLOCK
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug1: send channel open 0
debug1: Entering interactive session.
debug2: callback start
debug1: ssh_session2_setup: id 0
debug1: Sending subsystem: sftp
debug1: channel request 0: subsystem
debug2: callback done
debug1: channel 0: open confirm rwindow 0 rmax 32768
debug2: channel 0: rcvd adjust 131072
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: channel 0: rcvd eof
debug1: channel 0: output open -> drain
debug1: channel 0: obuf empty
debug1: channel 0: close_write
debug1: channel 0: output drain -> closed
debug1: channel 0: rcvd close
debug1: channel 0: close_read
debug1: channel 0: input open -> closed
debug3: channel 0: will not send data after close
debug1: channel 0: almost dead
debug1: channel 0: gc: notify user
debug1: channel 0: gc: user detached
debug1: channel 0: send close
debug1: channel 0: is dead
debug1: channel 0: garbage collecting
debug1: channel_free: channel 0: client-session, nchannels 1
debug3: channel_free: status: The following connections are open:
  #0 client-session (t4 r0 i3/0 o3/0 fd -1/-1)

debug3: channel_close_fds: channel 0: r -1 w -1 e 6
debug1: fd 0 clearing O_NONBLOCK
debug2: fd 1 is not O_NONBLOCK
debug1: Transferred: stdin 0, stdout 0, stderr 0 bytes in 1.5 seconds
debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 0.0
debug1: Exit status 1
Connection closed

Also /var/log/messages :

sshd(pam_unix)[5050]: session opened for user dexgate by (uid=0)
rssh[5051]: setting log facility to LOG_USER
rssh[5051]: allowing sftp to all users
rssh[5051]: setting umask to 022
rssh[5051]: chrooting all users to /usr/chroot/
rssh[5051]: line 25: configuring user my_user
rssh[5051]: setting my_user's umask to 011
rssh[5051]: allowing sftp to user my_user
rssh[5051]: chrooting my_user to /usr/chroot/home/my_user
rssh[5051]: chroot cmd line: /usr/libexec/rssh_chroot_helper 
"/usr/chroot/home/my_user" 2 "/" /usr/libexec/openssh/sftp-server
sshd(pam_unix)[5050]: session closed for user my_user


This is all. What is wrong?

I've tryed without chroot and sftp connection works fine, but I need chroot 
jail!

What's the problem?

Thanks

_________________________________________________________________
Personalizza MSN Messenger con sfondi e fotografie! 
http://www.ilovemessenger.msn.it/

Re: Problem setting up rssh

[Derek M. <co...@pi...>]

On Tue, Dec 09, 2003 at 12:18:26PM -0800, Robert Minsk wrote:
[BIG SNIP]
> The file
> /var/spool/ftp/dir/usr/libexec/openssh/sftp-server
> exists.
> 
> What have I done wrong?

Robert,

I've looked at your description of what you did to set up your jail,
and I don't see anything obviously wrong.  However, odds are good that
you've missed some important library somewhere.  That is almost always
the problem.  Your configuration looks fine.

All I can really say about it is to reiterate what I said in the
CHROOT documentation: setting up a chroot jail is complicated, and
very much system-dependent.  So I really can't provide any better
explanation as to what you may have done wrong.  Ultimately, I can't
support chroot jail configurations.

Sorry I can't be of any more help...

Derek

-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

Problem setting up rssh

[Robert M. <rob...@ya...>]

Some of the names in this file have been change for
security reasons...

Linux machine 2.4.20-13.9 #1 Mon May 12 10:55:37 EDT
2003 i686 i686 i386 GNU/Linux

> rpm -qa | grep openssh
openssh-clients-3.5p1-6
openssh-3.5p1-6
openssh-server-3.5p1-6

I installed rssh-2.1.1-1.RH9.i386.rpm.

The entry in /etc/rssh.conf:
user=hiduser:002:11:/var/spool/ftp/dir

#!/bin/sh
mkdir -p /var/spool/ftp/dir
cd /var/spool/ftp/dir

for i in /usr/bin/scp /usr/libexec/openssh/sftp-server
/usr/libexec/rssh_chroot_helper; do
  tar -cBf - $i | tar -xBvf -
  tar -cBf - `ldd $i | awk '{ print $3 }'` | tar -xBvf
-
done

tar -cBf - /etc/passwd /etc/ld.so*
/lib/libnss_files.so.? | tar -xBvf -

mkdir dev

When I try to sftp to the machine I get:
Dec  3 21:11:39 machine sshd(pam_unix)[7748]: session
opened for user hiduser by (uid=3004)
Dec  3 21:11:39 machine rssh[7749]: setting log
facility to LOG_USER
Dec  3 21:11:39 machine rssh[7749]: setting umask to
022
Dec  3 21:11:39 machine rssh[7749]: line 41:
configuring user hiduser
Dec  3 21:11:39 machine rssh[7749]: setting hiduser's
umask to 02
Dec  3 21:11:39 machine rssh[7749]: allowing scp to
user hiduser
Dec  3 21:11:39 machine rssh[7749]: allowing sftp to
user hiduser
Dec  3 21:11:39 machine rssh[7749]: chrooting hiduser
to /var/spool/ftp/dir
Dec  3 21:11:39 machine rssh[7749]: chroot cmd line:
/usr/libexec/rssh_chroot_helper "/var/spool/ftp/dir" 2
"/" /usr/libexec/openssh/sftp-server
Dec  3 21:11:39 machine sshd(pam_unix)[7748]: session
closed for user hiduser
Dec  4 05:11:39 machine rssh_chroot_helper[7749]: new
session for hiduser, UID=3004
Dec  4 05:11:39 machine rssh_chroot_helper[7749]:
execv() failed, /usr/libexec/openssh/sftp-server: No
such file or directory

The file
/var/spool/ftp/dir/usr/libexec/openssh/sftp-server
exists.

What have I done wrong?

__________________________________
Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing.
http://photos.yahoo.com/

Problem setting up rssh

[Robert M. <rob...@ya...>]

Some of the names in this file have been change for
security reasons...

Linux machine 2.4.20-13.9 #1 Mon May 12 10:55:37 EDT
2003 i686 i686 i386 GNU/Linux

> rpm -qa | grep openssh
openssh-clients-3.5p1-6
openssh-3.5p1-6
openssh-server-3.5p1-6

I installed rssh-2.1.1-1.RH9.i386.rpm.

The entry in /etc/rssh.conf:
user=hiduser:002:11:/var/spool/ftp/dir

#!/bin/sh
mkdir -p /var/spool/ftp/dir
cd /var/spool/ftp/dir

for i in /usr/bin/scp /usr/libexec/openssh/sftp-server
/usr/libexec/rssh_chroot_helper; do
  tar -cBf - $i | tar -xBvf -
  tar -cBf - `ldd $i | awk '{ print $3 }'` | tar -xBvf
-
done

tar -cBf - /etc/passwd /etc/ld.so*
/lib/libnss_files.so.? | tar -xBvf -

mkdir dev

When I try to sftp to the machine I get:
Dec  3 21:11:39 machine sshd(pam_unix)[7748]: session
opened for user hiduser by (uid=3004)
Dec  3 21:11:39 machine rssh[7749]: setting log
facility to LOG_USER
Dec  3 21:11:39 machine rssh[7749]: setting umask to
022
Dec  3 21:11:39 machine rssh[7749]: line 41:
configuring user hiduser
Dec  3 21:11:39 machine rssh[7749]: setting hiduser's
umask to 02
Dec  3 21:11:39 machine rssh[7749]: allowing scp to
user hiduser
Dec  3 21:11:39 machine rssh[7749]: allowing sftp to
user hiduser
Dec  3 21:11:39 machine rssh[7749]: chrooting hiduser
to /var/spool/ftp/dir
Dec  3 21:11:39 machine rssh[7749]: chroot cmd line:
/usr/libexec/rssh_chroot_helper "/var/spool/ftp/dir" 2
"/" /usr/libexec/openssh/sftp-server
Dec  3 21:11:39 machine sshd(pam_unix)[7748]: session
closed for user hiduser
Dec  4 05:11:39 machine rssh_chroot_helper[7749]: new
session for hiduser, UID=3004
Dec  4 05:11:39 machine rssh_chroot_helper[7749]:
execv() failed, /usr/libexec/openssh/sftp-server: No
such file or directory

The file
/var/spool/ftp/dir/usr/libexec/openssh/sftp-server
exists.

What have I done wrong?


__________________________________
Do you Yahoo!?
Free Pop-Up Blocker - Get it now
http://companion.yahoo.com/

rssh, chroot ok, but one syntaxis not run

[Jose M.H. <jhe...@in...>]

I have:

allowsftp
chrootpath="/usr/chroot"

Now...  the chroot run perfect, but I don't understand why not run, the follow 
syntaxis:

user=test:011:11:"/usr/chroot  /usr/chroot/jotin"      

Thanks for your help...