rssh-discuss Mailing List for rssh (Page 31)
Brought to you by:
xystrus
You can subscribe to this list here.
2003 |
Jan
|
Feb
|
Mar
|
Apr
|
May
(4) |
Jun
(1) |
Jul
(15) |
Aug
(33) |
Sep
(5) |
Oct
(15) |
Nov
(8) |
Dec
(4) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2004 |
Jan
(5) |
Feb
|
Mar
(5) |
Apr
(4) |
May
(4) |
Jun
(15) |
Jul
(9) |
Aug
(11) |
Sep
(5) |
Oct
(2) |
Nov
|
Dec
(6) |
2005 |
Jan
(8) |
Feb
(6) |
Mar
(43) |
Apr
(2) |
May
(5) |
Jun
(6) |
Jul
(12) |
Aug
(22) |
Sep
(5) |
Oct
(7) |
Nov
(15) |
Dec
(5) |
2006 |
Jan
(60) |
Feb
(7) |
Mar
(12) |
Apr
(7) |
May
(5) |
Jun
(14) |
Jul
(19) |
Aug
(21) |
Sep
(16) |
Oct
(2) |
Nov
(15) |
Dec
(3) |
2007 |
Jan
|
Feb
|
Mar
|
Apr
(24) |
May
|
Jun
(26) |
Jul
(12) |
Aug
(1) |
Sep
(7) |
Oct
(2) |
Nov
|
Dec
(1) |
2008 |
Jan
(4) |
Feb
(6) |
Mar
(4) |
Apr
(4) |
May
(5) |
Jun
(4) |
Jul
(4) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
2009 |
Jan
|
Feb
(27) |
Mar
(20) |
Apr
(8) |
May
(1) |
Jun
(1) |
Jul
|
Aug
(3) |
Sep
(2) |
Oct
(1) |
Nov
|
Dec
|
2010 |
Jan
(3) |
Feb
(1) |
Mar
(3) |
Apr
|
May
|
Jun
(4) |
Jul
(7) |
Aug
(6) |
Sep
(7) |
Oct
(1) |
Nov
|
Dec
|
2011 |
Jan
|
Feb
(5) |
Mar
(5) |
Apr
(16) |
May
|
Jun
(6) |
Jul
(20) |
Aug
(10) |
Sep
(4) |
Oct
|
Nov
|
Dec
(7) |
2012 |
Jan
(5) |
Feb
|
Mar
(9) |
Apr
|
May
(6) |
Jun
(3) |
Jul
(1) |
Aug
|
Sep
|
Oct
(1) |
Nov
(5) |
Dec
(6) |
2013 |
Jan
|
Feb
|
Mar
(5) |
Apr
|
May
|
Jun
|
Jul
(2) |
Aug
(2) |
Sep
(3) |
Oct
(1) |
Nov
(1) |
Dec
|
2014 |
Jan
(5) |
Feb
|
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
(7) |
Sep
|
Oct
|
Nov
|
Dec
|
2015 |
Jan
|
Feb
|
Mar
|
Apr
(4) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(2) |
Nov
(7) |
Dec
|
2016 |
Jan
|
Feb
|
Mar
(4) |
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(11) |
Nov
|
Dec
|
2018 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
(2) |
2019 |
Jan
(8) |
Feb
(17) |
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(3) |
Dec
|
2020 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(1) |
Dec
|
2021 |
Jan
(4) |
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
2022 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(1) |
Nov
|
Dec
|
From: Derek M. <co...@pi...> - 2004-06-04 01:28:34
|
On Thu, Jun 03, 2004 at 11:32:57AM +0200, Yves Martin wrote: > > Hello, > > I get the 2.2 version because I'm looking for a 'cvs' support in a > secured shell. I find it strange that 2.2 version has no official > home page with download, FAQ and docs. Why ? Is it a fork ? No... It's because a) I'm lazy, and b) it has a bug which I've fixed and now I need to release an update. So I never bothered to update the website, etc. I'll release 2.2.1 this weekend, I guess. > Except that details, I was able to create my chroot jail (manually) > and use cvs - with that trouble: > > In commit, cvs used "uid753" instead of "testcvs". I does not look > good in cvs log. > Same issue, scp refuse to work: unknown user 753 > > I have correctly copied /etc/nsswitch.conf, passwd and group in my > jail - BUT libnss_files lacks and it is impossible to find out except > with a > strace chroot /myjail getent passwd testcvs > run as root. That library is not refered by ldd ! So take care. If I understand you correctly, the problem was you didn't copy libnss_files.* to your jail. You're right that ldd won't show this library. However the CHROOT file specifically mentions this issue... mkchroot.sh also warns about it. > I found a bug when reading the mkchroot.sh script: > replace /usr/bin/scp by $prog in ldd command: > > for prog in $scp_path $sftp_server_path $rssh_path $chroot_helper_path; do > echo "Copying libraries for $prog." > libs=`ldd /usr/bin/scp | tr -s ' ' | cut -d' ' -f3` Thanks, fixed. :) > Another point: if I do > ./configure --with-scp /bin/scp --with-cvs /bin/cvs > I expect the code to use that paths and not autodetected /usr/bin/scp > and /usr/bin/cvs from my PATH instead of my options. It would, if you did it correctly. You need to use the equal sign: --with-scp=/bin/scp > Thank you for your job on that must-have tool ! You're welcome! :) -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Yves M. <yve...@el...> - 2004-06-03 09:33:12
|
Hello, I get the 2.2 version because I'm looking for a 'cvs' support in a secured shell. I find it strange that 2.2 version has no official home page with download, FAQ and docs. Why ? Is it a fork ? Except that details, I was able to create my chroot jail (manually) and use cvs - with that trouble: In commit, cvs used "uid753" instead of "testcvs". I does not look good in cvs log. Same issue, scp refuse to work: unknown user 753 I have correctly copied /etc/nsswitch.conf, passwd and group in my jail - BUT libnss_files lacks and it is impossible to find out except with a strace chroot /myjail getent passwd testcvs run as root. That library is not refered by ldd ! So take care. I found a bug when reading the mkchroot.sh script: replace /usr/bin/scp by $prog in ldd command: for prog in $scp_path $sftp_server_path $rssh_path $chroot_helper_path; do echo "Copying libraries for $prog." libs=`ldd /usr/bin/scp | tr -s ' ' | cut -d' ' -f3` Another point: if I do ./configure --with-scp /bin/scp --with-cvs /bin/cvs I expect the code to use that paths and not autodetected /usr/bin/scp and /usr/bin/cvs from my PATH instead of my options. Thank you for your job on that must-have tool ! -- Yves Martin |
From: Derek M. <co...@pi...> - 2004-05-25 21:27:20
|
On Mon, May 24, 2004 at 11:56:12PM -0700, rss...@as... wrote: > Consider the following line in /etc/rssh.conf: > > user = test:002:11111: > > If I read the documentation correctly, test should be able to rsync, > rdist, cvs, sftp and scp. However only sftp and scp seem to be > honored: Oops... I meant to include the patch for this in my last post. Here it is: --- rsshconf.c 2004-05-23 15:27:43.000000000 +0900 +++ rsshconf.c.fixed 2004-05-23 15:23:10.000000000 +0900 @@ -919,6 +919,18 @@ log_msg("allowing sftp to user %s", user); opts->shell_flags |= RSSH_ALLOW_SFTP; } + if ( allow_cvs ){ + log_msg("allowing cvs to user %s", user); + opts->shell_flags |= RSSH_ALLOW_CVS; + } + if ( allow_rdist ){ + log_msg("allowing rdist to user %s", user); + opts->shell_flags |= RSSH_ALLOW_RDIST; + } + if ( allow_rsync ){ + log_msg("allowing rsync to user %s", user); + opts->shell_flags |= RSSH_ALLOW_RSYNC; + } if ( path ){ log_msg("chrooting %s to %s", user, path); opts->shell_flags |= RSSH_USE_CHROOT; -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Derek M. <co...@pi...> - 2004-05-25 20:54:27
|
On Mon, May 24, 2004 at 11:45:14PM -0700, rss...@as... wrote: > The source, by default in v2.2.0, installs the rssh_chroot_helper > in /usr/local/libexec/rssh_chroot_helper. However the pathname.h > file that is built by configure has PATH_CHROOT_HELPER hard coded > to /usr/local/bin/rssh_chroot_helper. Look again; it only does that if it isn't already defined. If you run configure appropriately, it will be defined... > It would be nice if pathname.h honored the --prefix config > convention. It does. But --prefix doesn't set the location of libexec files... I suggest you read the output of configure --help. Hint: you're looking for --exec-prefix. :) $ rpm -ql rssh /etc/rssh.conf /usr/bin/rssh /usr/libexec/rssh_chroot_helper [...] > The following patch will cause pathname.h to be built > with PATH_CHROOT_HELPER set under a libexec sub-directory. Thanks, but no thanks. If you run configure properly, it already does that. I think the issue here is that recent versions of autoconf/automake have changed the behavior of the configure script, and people are just not yet aware/accustomed to the change. Maybe I'll add this to the INSTALL file... On Mon, May 24, 2004 at 11:56:12PM -0700, rss...@as... wrote: > Consider the following line in /etc/rssh.conf: > > user = test:002:11111: Yes, I am aware of this problem, and in fact it's already fixed. I just need to re-release the code, which I will probably do this weekend. I've been really strapped for spare time lately. Real life intrudes... Check the website on Saturday for a release. Or look in the source and add the necessary 6 lines yourself... ;-) I'm not sure how I managed to release the code without them, but nobody's perfect... Sigh. Thanks for bringing these issues up, though. Free software works well because people work together to make it work well. -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: <rss...@as...> - 2004-05-25 07:07:00
|
Consider the following line in /etc/rssh.conf: user = test:002:11111: If I read the documentation correctly, test should be able to rsync, rdist, cvs, sftp and scp. However only sftp and scp seem to be honored: May 24 23:28:18 hostname rssh[17811]: setting log facility to LOG_USER May 24 23:28:18 hostname rssh[17811]: setting umask to 022 May 24 23:28:18 hostname rssh[17811]: line 50: configuring user test May 24 23:28:18 hostname rssh[17811]: setting test's umask to 02 May 24 23:28:18 hostname rssh[17811]: allowing scp to user test May 24 23:28:18 hostname rssh[17811]: allowing sftp to user test If I comment OUT / remove the "user = test:002:11111:" line, and comment IN / enable all 5 global allow* lines: allowscp allowsftp allowcvs allowrdist allowrsync ... #user = test:002:11111: I get: May 25 00:00:36 hostname rssh[18139]: setting log facility to LOG_USER May 25 00:00:36 hostname rssh[18139]: allowing scp to all users May 25 00:00:36 hostname rssh[18139]: allowing sftp to all users May 25 00:00:36 hostname rssh[18139]: allowing cvs to all users May 25 00:00:36 hostname rssh[18139]: allowing rdist to all users May 25 00:00:36 hostname rssh[18139]: allowing rsync to all users May 25 00:00:36 hostname rssh[18139]: setting umask to 022 A test of rsync shows that it works when the global 'allowrsync' is set and the user line is commented out. However rsync fails with the '11111' access bits for a particular user is used. I am using the rssh v2.2.0 source tarball on RHEL3. chongo (http://www.isthe.com/chongo/index.html) /\oo/\ |
From: <rss...@as...> - 2004-05-25 06:55:29
|
The source, by default in v2.2.0, installs the rssh_chroot_helper in /usr/local/libexec/rssh_chroot_helper. However the pathname.h file that is built by configure has PATH_CHROOT_HELPER hard coded to /usr/local/bin/rssh_chroot_helper. It would be nice if pathname.h honored the --prefix config convention. It is reasonable to place rssh_chroot_helper under libexec somewhere. The following patch will cause pathname.h to be built with PATH_CHROOT_HELPER set under a libexec sub-directory. By default (without using --prefix) the PATH_CHROOT_HELPER is /usr/local/libexec/rssh_chroot_helper (which is where the Makefile actually installs rssh_chroot_helper now). The --prefix value is now honored. For example, if one does: ./configure --prefix=/usr then PATH_CHROOT_HELPER in pathname.h becomes: /usr/libexec/rssh_chroot_helper --- pathnames.h.in.init 2003-08-08 14:49:28.000000000 -0700 +++ pathnames.h.in 2004-05-24 23:20:34.000000000 -0700 @@ -43,7 +43,7 @@ #endif /* PATH_RSSH_CONFIG */ #ifndef PATH_CHROOT_HELPER -#define PATH_CHROOT_HELPER "/usr/local/bin/rssh_chroot_helper" +#define PATH_CHROOT_HELPER "@prefix@/libexec/rssh_chroot_helper" #endif /* PATH_CHROOT_HELPER */ #endif /* _rssh_pathnames_h */ chongo (http://www.isthe.com/chongo/index.html) /\oo/\ |
From: Derek M. <co...@pi...> - 2004-04-07 03:46:06
|
On Sun, Apr 04, 2004 at 07:58:55PM +0200, Lukasz Piskorz wrote: > Hi, >=20 > Thanks a lot for your help. My rssh shell still doesn't work. Ok, let's see what we can do. > I copied all files and direcotires from /lib and /usr/lib/ in order to be > sure that no one file is missing. According to your tip I checked: > #ldd `which sftp` Looks like you have all the libraries. That's good. But the problem with copying everything is that now, if I want to see the contents of your jail to look at what might be missing, I would have to look at a whole lot of irrelevant files. And of course, they do take up space on your hard drive... > My problem is still the same. I can't login to system with rssh. > I write again: > Use sftp with debug option. The debug output to sftp is really not helpful. We already know the problem is with your installation of rssh, not with sftp. > May I ask you again? How can I solve this problem? If you want more > information about my system write to me. Please post your complete rssh.conf file, any related log messages =66rom a failed access attempt, and the contents of the etc directory *INSIDE the chroot jail*. I'll look, but I can't make promises. As I say in all the documentation, I don't really support setting up chroot jails, because it's complicated and system-dependent. --=20 Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Lukasz P. <lpi...@is...> - 2004-04-04 17:58:44
|
Hi, Thanks a lot for your help. My rssh shell still doesn't work. >> I try to compile, configure and use rssh. I read CHROOT files and >> configure my system. > >Well, you have at least one obvious (to me) mistake. Depending on >what distro you have, there may be others. I use Linux Debian woody with kernel 2.2. >> I configure /usr/local/etc/rssh file >> What do I change? >> 1. Uncommented >> allowscp >> allowsftp >> 2. Change line: >> chrootpath="/usr/sbin/chroot /usr/chroot/" > >This is wrong. The chrootpath line should contain ONLY the path to >the directory you will use as your chroot jail. You have the path to >the chroot binary here. The chroot binary is 100% irrelevant to rssh. > >With what you have, rssh is trying to chroot to the directory >"/usr/sbin/chroot /usr/chroot/", which almost certainly doesn't exist. >Based on what you wrote after this, it should read as follows: > > chrootpath="/usr/chroot/" I corrected my mistake. chrootpath="/usr/chroot/" >> 1. Create new user test. In /etc/passwd I have line: >> test:x:1010:1010:,,,:/usr/chroot:/usr/local/bin/rssh >> 2. mkdir /usr/chroot >> 3. mkdir /usr/chroot/lib /usr/chroot/etc/ /usr/chroot/local/bin/ >> 4. cp -r /lib/* /usr/chroot/ >> 5. cp /usr/bin/scp /usr/chroot/usr/bin/scp >> 6. cp /usr/bin/sftp-server /usr/chroot/usr/bin/sftp-server >> 7. cp /usr/local/bin/rssh /usr/chroot/usr/local/bin/rssh >> 8. cp /usr/local/etc/rssh /usr/chroot/usr/local/etc/rssh >> 9. cp /etc/ld* /usr/chroot/etc/ >> 10. cp /etc/passwd /usr/chroot/etc/ >> 11. cp -r /etc/ssh* /usr/chroot/ >> 12. cp /usr/lib/lib* /usr/chroot/usr/lib/ > >If you're using Red Hat, I'm pretty sure there's at least one >necessary library which is not in either /lib or /usr/lib. Be sure to >use the ldd command, as mentioned in the CHROOT file, to figure out >exactly what libraries you need. I copied all files and direcotires from /lib and /usr/lib/ in order to be sure that no one file is missing. According to your tip I checked: #ldd `which sftp` debian:/usr/chroot# ldd `which sftp` libutil.so.1 => /lib/libutil.so.1 (0x4001c000) libz.so.1 => /lib/libz.so.1 (0x4001f000) libnsl.so.1 => /lib/libnsl.so.1 (0x4002c000) libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x40040000) libc.so.6 => /lib/libc.so.6 (0x400fa000) libdl.so.2 => /lib/libdl.so.2 (0x4022a000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) and #ldd `which scp` libutil.so.1 => /lib/libutil.so.1 (0x4001c000) libz.so.1 => /lib/libz.so.1 (0x4001f000) libnsl.so.1 => /lib/libnsl.so.1 (0x4002c000) libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x40040000) libc.so.6 => /lib/libc.so.6 (0x400fa000) libdl.so.2 => /lib/libdl.so.2 (0x4022a000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) All files from the list above are in chrootpath /usr/chroot/... My problem is still the same. I can't login to system with rssh. I write again: Use sftp with debug option. #sftp -v test@192.168.1.1 Connecting to 192.168.1.1... OpenSSH_3.4p1 Debian 1:3.4p1-1.woody.3, SSH protocols 1.5/2.0, OpenSSL 0x0090603f [...] debug1: next auth method to try is password test@192.168.1.1's password: xxxxx debug1: ssh-userauth2 successful: method password debug1: fd 4 setting O_NONBLOCK debug1: channel 0: new [client-session] debug1: send channel open 0 debug1: Entering interactive session. debug1: ssh_session2_setup: id 0 debug1: Sending subsystem: sftp debug1: channel request 0: subsystem debug1: channel 0: open confirm rwindow 10000 rmax 32768 debug1: client_input_channel_req: channel 0 rtype exit-signal reply 0 debug1: channel 0: rcvd close debug1: channel 0: output open -> drain debug1: channel 0: close_read debug1: channel 0: input open -> closed debug1: channel 0: obuf empty debug1: channel 0: close_write debug1: channel 0: output drain -> closed debug1: channel 0: almost dead debug1: channel 0: gc: notify user debug1: channel 0: gc: user detached debug1: channel 0: send close debug1: channel 0: is dead debug1: channel 0: garbage collecting debug1: channel_free: channel 0: client-session, nchannels 1 debug1: fd 0 clearing O_NONBLOCK debug1: Transferred: stdin 0, stdout 0, stderr 0 bytes in 0.0 seconds debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 0.0 debug1: Exit status -1 Connection closed # May I ask you again? How can I solve this problem? If you want more information about my system write to me. Luke |
From: Derek M. <co...@pi...> - 2004-04-04 04:15:20
|
On Fri, Apr 02, 2004 at 12:21:47PM +0200, lpi...@ka... wrote: > Hi all, Hi! > I try to compile, configure and use rssh. I read CHROOT files and > configure my system. Well, you have at least one obvious (to me) mistake. Depending on what distro you have, there may be others. > I configure /usr/local/etc/rssh file > What do I change? > 1. Uncommented > allowscp > allowsftp > 2. Change line: > chrootpath="/usr/sbin/chroot /usr/chroot/" This is wrong. The chrootpath line should contain ONLY the path to the directory you will use as your chroot jail. You have the path to the chroot binary here. The chroot binary is 100% irrelevant to rssh. With what you have, rssh is trying to chroot to the directory "/usr/sbin/chroot /usr/chroot/", which almost certainly doesn't exist. Based on what you wrote after this, it should read as follows: chrootpath="/usr/chroot/" > 1. Create new user test. In /etc/passwd I have line: > test:x:1010:1010:,,,:/usr/chroot:/usr/local/bin/rssh > 2. mkdir /usr/chroot > 3. mkdir /usr/chroot/lib /usr/chroot/etc/ /usr/chroot/local/bin/ > 4. cp -r /lib/* /usr/chroot/ > 5. cp /usr/bin/scp /usr/chroot/usr/bin/scp > 6. cp /usr/bin/sftp-server /usr/chroot/usr/bin/sftp-server > 7. cp /usr/local/bin/rssh /usr/chroot/usr/local/bin/rssh > 8. cp /usr/local/etc/rssh /usr/chroot/usr/local/etc/rssh > 9. cp /etc/ld* /usr/chroot/etc/ > 10. cp /etc/passwd /usr/chroot/etc/ > 11. cp -r /etc/ssh* /usr/chroot/ > 12. cp /usr/lib/lib* /usr/chroot/usr/lib/ If you're using Red Hat, I'm pretty sure there's at least one necessary library which is not in either /lib or /usr/lib. Be sure to use the ldd command, as mentioned in the CHROOT file, to figure out exactly what libraries you need. Also, your step #11 should be unnecessary. SSHD reads the files it needs in /etc/ssh long before rssh gets involved. Derek -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: <lpi...@ka...> - 2004-04-02 10:21:55
|
Hi all, I'm new in this group but welcome everybody. I try to compile, configure and use rssh. I read CHROOT files and configure my system. When I try to use sftp from other system I see message: debian:~# sftp test@192.168.1.1 Connecting to 192.168.1.1... test@192.168.1.1's password: Connection closed debian:~# I couldn't login to debian system. Could you help me and tell me what I did wrong? When I configured system (after read CHROOT file) I did I configure /usr/local/etc/rssh file What do I change? 1. Uncommented allowscp allowsftp 2. Change line: chrootpath="/usr/sbin/chroot /usr/chroot/" 1. Create new user test. In /etc/passwd I have line: test:x:1010:1010:,,,:/usr/chroot:/usr/local/bin/rssh 2. mkdir /usr/chroot 3. mkdir /usr/chroot/lib /usr/chroot/etc/ /usr/chroot/local/bin/ 4. cp -r /lib/* /usr/chroot/ 5. cp /usr/bin/scp /usr/chroot/usr/bin/scp 6. cp /usr/bin/sftp-server /usr/chroot/usr/bin/sftp-server 7. cp /usr/local/bin/rssh /usr/chroot/usr/local/bin/rssh 8. cp /usr/local/etc/rssh /usr/chroot/usr/local/etc/rssh 9. cp /etc/ld* /usr/chroot/etc/ 10. cp /etc/passwd /usr/chroot/etc/ 11. cp -r /etc/ssh* /usr/chroot/ 12. cp /usr/lib/lib* /usr/chroot/usr/lib/ And all, |
From: Derek M. <co...@pi...> - 2004-03-30 01:02:49
|
On Tue, Jan 06, 2004 at 07:21:18PM +0000, Monchanin Eric wrote: > Hi there, I browsed a little on the web, and on the archives of this > mailing list ... but couldn't find my answer, so here is my problem [SNIP] > when I try to connect using sftp, I got a: >=20 > Jan 6 11:37:12 galadriel sshd(pam_unix)[14340]: session opened for user > test2 by (uid=3D506) > Jan 6 11:37:12 galadriel rssh[14341]: setting log facility to LOG_USER > Jan 6 11:37:12 galadriel rssh[14341]: allowing scp to all users > Jan 6 11:37:12 galadriel rssh[14341]: allowing sftp to all users > Jan 6 11:37:12 galadriel rssh[14341]: line 34: configuring user test2 > Jan 6 11:37:12 galadriel rssh[14341]: setting test2's umask to 077 > Jan 6 11:37:12 galadriel rssh[14341]: allowing scp to user test2 > Jan 6 11:37:12 galadriel rssh[14341]: allowing sftp to user test2 > Jan 6 11:37:12 galadriel rssh[14341]: user test2 attempted to execute > forbidden commands > Jan 6 11:37:12 skycore1 rssh[14341]: command: > /usr/libexec/openssh/sftp-server > Jan 6 11:37:13 skycore1 sshd(pam_unix)[14340]: session closed for user t= est2 >=20 > I don't know what to do, so if you have any idea ... Well the only thing that comes to mind is that rssh thinks /usr/libexec/openssh/sftp-server is a forbidden command, so when you ran configure, you may have configured the sftp-server binary to be in a different location. Possibly, you have two versions of SSH installed, and the configure script picked up the sftp-server binary =66rom the wrong one. Other than that, maybe you could send the output =66rom ./configure to help diagnose the problem. That is, if this still is a problem... Sorry about the long response time. --=20 Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Derek M. <co...@pi...> - 2004-03-30 00:44:51
|
On Fri, Nov 21, 2003 at 10:50:55AM -0500, Anthony Rabaa wrote: > Hello, > > I've been fiddling with rssh and jailed sftp access for over a day and > I'm stumped trying to figure out why my test login can successfully log > in just to be bumped back out. I'm probably missing something obvious > and hopefully somebody may be able to point out my problem. There are > two flavours I'm installing this on; Redhat 8 and another derived from > Debian. The Debian system was simple to setup, jail working an all. > Not so good for Redhat though. Sorry, I seem to have missed this message the first time around. Did you get it working? -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Greg C. <Gre...@we...> - 2004-03-16 00:00:30
|
We are trying to compile rssh 2.1.0. We are running AIX 5.1 and gcc is version 2.9-aix51-020209. We seem to run into a problem though, and we cannot finish: > make make all-am gcc -c -DHAVE_CONFIG_H -DPATH_RSSH_CONFIG=3D\"/usr/local/etc/rssh.conf\" -DPATH_CHROOT_HELPER=3D\"/usr/local/libexec/rssh_chroot_helper\" -g -O2 rsshconf.c In file included from /usr/bin/../lib/gcc-lib/powerpc-ibm-aix4.3.3.0/2.9-aix51-020209/include/ sys/signal.h:349, from /usr/include/signal.h:20, from rsshconf.c:49: /usr/include/sys/context.h:155: parse error before `sigset64_t' /usr/include/sys/context.h:155: warning: no semicolon at end of struct or union /usr/include/sys/context.h:158: parse error before `}' make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 2. Has anyone else seen this error? If so, any know way to fix it? Thanks in advance. |
From: Derek M. <co...@pi...> - 2004-03-13 07:36:31
|
On Fri, Mar 12, 2004 at 10:59:08PM +0000, Enrico Weigelt wrote: > > Hi folks, > > is there a way to use rssh for rsync ? Well, sort of... I was working on an update to rssh which allowed this, but I never released it because I hadn't gotten around to testing the rsync, rdist, and cvs support thoroughly. Unfortunately, before I got to do that, I had a catastrophic problem which caused me to lose access to my source tree... I had to re-format my laptop's hard drive, but the back-up I did of my home directory failed. I had two other back-ups of the code. One was on my other laptop, which simultaneously developed a hardware problem, making it unusable. The third copy is sitting on a computer in my parents' basement, litterally half way around the world from where I am right now. I won't have access to that machine again until December. So in short, it does... but not usefully. The code to do so won't be publicly available until a) I get access to the data from one of the two remaining machines where it lives, b) I get bored enough to download a copy of the source from SF and re-write the changes, or c) until someone else does it... FWIW, the code necessary to make it work is pretty easy to add. But these days I'm extrememly busy, so I don't have much time to spend on it. My priorities are elsewhere... -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Enrico W. <we...@me...> - 2004-03-12 23:04:54
|
Hi folks, is there a way to use rssh for rsync ? cu -- --------------------------------------------------------------------- Enrico Weigelt == metux IT services phone: +49 36207 519931 www: http://www.metux.de/ fax: +49 36207 519932 email: co...@me... cellphone: +49 174 7066481 --------------------------------------------------------------------- -- DSL-Zugang ab 0 Euro. -- statische IP -- UUCP -- Hosting -- --------------------------------------------------------------------- |
From: Derek M. <co...@pi...> - 2004-01-31 18:16:38
|
On Mon, Dec 22, 2003 at 03:00:23PM +0000, Laura Rossi wrote: > Hi! Hi Laura, Sorry to take so long getting back to you. I've moved across the world and have only had limited Internet access up to now... > I'm a new user of rssh and I've just set up a chroot jail for one user on > RedHat 7.3. You're aware that Red Hat 7.3 is EOL and unsupported (as are all other releases up to Red Hat 8, with RH9 soon to follow in April). I believe there are already known security holes in RH 7.3 which Red Hat will not fix. Spending time setting up chroot jails may be a waste of your time... > I've create the following directories and copy the files (as > described in > CHROOT file): > > /usr/chroot/ [SNIP] So it seems that you want the chroot jail to be located in /usr/chroot, right? > my rssh.conf is: > > logfacility = LOG_USER # you can use comments at end of line > allowsftp > umask = 022 > chrootpath=/usr/chroot/ > user=my_user:011:10:/usr/chroot/home/my_user Well, then that's the problem. You told rssh that the base of the chroot jail for "my_user" is /usr/chroot/home/my_user, NOT /usr/chroot. I suggest you have another look at the man page for rssh.conf, if this is still a problem for you. Note particularly the documentation about the "user=" directive. I didn't see anything else wrong, but if you still have problems after you fix the user= line, you may have missed a library somewhere. -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Derek M. <co...@pi...> - 2004-01-31 11:00:16
|
On Wed, Jan 28, 2004 at 11:26:02AM +0100, Francisco Peralta Aguaron wrote: > maybe somebody can help me.. > I#m looking for a solution to implement somehow an upload only space > with sftp or scp, where different users should be able to upload files > on a directory but not being able to delete things from (maybe there > is some option not mentioned in the manual of rssh.conf where i can > disable the deletion of a file?) because aproaching this problem only > with chmod seems rather difficult.. ;) I'm sorry, but this is simply not possible with any existing implementation of SSH. You'd have to re-write the clients to disallow copying from the remote host. I suspect this would be a difficult task. Or, well, it might be possible to implement that feature in rssh, but I have no intention of doing it... I'm basically done working on this thing. There are a few unresolved issues with it, which I may get around to dealing with eventually. Basically, I don't have a lot of time to deal with this these days. I've moved to South Korea, where I teach English, and I've only just gotten my Internet connection after having been here for 5 months. I've also lost my CVS repository for rssh, though I can probably recover that with a little effort, or I could start another from the source tarball. My motivation level to work on rssh these days is extremely low... In fact, if someone would like to take over maintaining it, I'd be happy to give it up. I sent someone on this list a tarball for rssh 2.1.2, which contains a small fix for using rssh with certain clients, as well as support for cvs and rsync/rdist. If that person it still tuned in, and still has that tarball, I'd greatly appreciate it if they would send it to me. Thanks -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Francisco P. A. <fra...@di...> - 2004-01-28 10:26:25
|
maybe somebody can help me.. I#m looking for a solution to implement somehow an upload only space with sftp or scp, where different users should be able to upload files on a directory but not being able to delete things from (maybe there is some option not mentioned in the manual of rssh.conf where i can disable the deletion of a file?) because aproaching this problem only with chmod seems rather difficult.. ;) thanks, Francisco:wq -- Dr. Francisco Peralta Aguaron SysAdmin DSY.it Dipartimento di Scienze dell'Informazione Forum Studenti fra...@di... te...@ds... http://www.10t8or.com http://www.dsy.it PGP-FP: BE5C 0DCA DDB2 3729 B348 4FF3 3BD6 BD7A 1AD6 FA95 |
From: MegaZone <meg...@me...> - 2004-01-19 22:13:31
|
I believe I'm running into the same issue covered in this email from last August: ---cut--- > Sep 1 22:34:56 unreal rssh[21732]: allowing sftp to user sftptest > Sep 1 22:34:56 unreal rssh[21732]: user sftptest attempted to > execute forbidden commands > Sep 1 22:34:56 unreal rssh[21732]: command: sftp-server This is because rssh is expecting the sftp client to pass it the full path to the sftp-server. What are you using on the client side? If you're using the OpenSSH sftp client, it SHOULD do that. But I guess there's no guarantee... I have run into this problem with certain clients, and I have fixed this in 2.1.2, which I haven't released yet. I believe it's ready for release, but the reason I haven't released it yet is because I added code to allow cvs, rsync, and rdist, which I have not had time to test. ---cut--- My log: Jan 19 15:39:37 techsrvc rssh[4791]: user sftptest attempted to execute forbidden commands Jan 19 15:39:37 techsrvc rssh[4791]: command: sftpserv Jan 19 15:39:39 techsrvc sshd(pam_unix)[4790]: session closed for user sftptest The server is Red Hat 8.0 with OpenSSH 3.4p1 with rssh 2.1.1 installed from RPM. The client is FreeBSD 4.8-Stable with OpenSSH 3.5p1 and sftp 0.9.7. It looks like the sftp client is just sending 'sftpserv'. The real parh on my RH8 box is - /usr/libexec/openssh/sftp-server It does seem to be working OK from SecureFX on WinXP and from another RH8.0 box. So it would appear to be the client on FreeBSD. -MZ, RHCE #806199299900541, ex-CISSP #3762 -- <URL:mailto:megazoneatmegazone.org> Gweep, Discordian, Author, Engineer, me. "A little nonsense now and then, is relished by the wisest men" 508-755-4098 <URL:http://www.megazone.org/> <URL:http://www.eyrie-productions.com/> Eris |
From: Monchanin E. <emo...@sk...> - 2004-01-06 18:20:23
|
Hi there, I browsed a little on the web, and on the archives of this mailing list ... but couldn't find my answer, so here is my problem I install rssh on a server and tried to configure a scp and sftp access for some users here is one of them: test2:x:506:100::/home/test2:/usr/bin/rssh my rssh.conf looks like that: **** logfacility = LOG_USER allowscp allowsftp user=test2:077:11:"/home/test" **** where /home/test is my chroot directory when I try to connect using sftp, I got a: Jan 6 11:37:12 galadriel sshd(pam_unix)[14340]: session opened for user test2 by (uid=506) Jan 6 11:37:12 galadriel rssh[14341]: setting log facility to LOG_USER Jan 6 11:37:12 galadriel rssh[14341]: allowing scp to all users Jan 6 11:37:12 galadriel rssh[14341]: allowing sftp to all users Jan 6 11:37:12 galadriel rssh[14341]: line 34: configuring user test2 Jan 6 11:37:12 galadriel rssh[14341]: setting test2's umask to 077 Jan 6 11:37:12 galadriel rssh[14341]: allowing scp to user test2 Jan 6 11:37:12 galadriel rssh[14341]: allowing sftp to user test2 Jan 6 11:37:12 galadriel rssh[14341]: user test2 attempted to execute forbidden commands Jan 6 11:37:12 skycore1 rssh[14341]: command: /usr/libexec/openssh/sftp-server Jan 6 11:37:13 skycore1 sshd(pam_unix)[14340]: session closed for user test2 I don't know what to do, so if you have any idea ... thanks a lot |
From: Laura R. <ar...@ho...> - 2003-12-22 15:00:29
|
Hi! I'm a new user of rssh and I've just set up a chroot jail for one user on RedHat 7.3. I've create the following directories and copy the files (as described in CHROOT file): /usr/chroot/ /usr/chroot/usr/bin/scp /usr/chroot/usr/libexec/openssh/sftp-server /usr/chroot/usr/local/bin/rssh_chrrot_helper copied in /usr/chroot/lib : /lib/libresolv.so.2 /lib/libutil.so.1 /lib/libnsl.so.1 /lib/libcrypto.so.2 /lib/i686/libc.so.6 /lib/libdl.so.2 /lib/ld-linux.so.2 copied in /usr/chroot/usr/lib : /usr/lib/libz.so.1 and then I've created : /usr/chroot/home/my_user my rssh.conf is: logfacility = LOG_USER # you can use comments at end of line allowsftp umask = 022 chrootpath=/usr/chroot/ user=my_user:011:10:/usr/chroot/home/my_user in my file passwd there is: my_user:x:501:0::/usr/chroot/home/my_user:/usr/bin/rssh There is passphrase to connect and then I received the message: Connection closed Verbose mode stamps this messages: Connecting to 192.168.X.X... OpenSSH_3.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Rhosts Authentication disabled, originating port will not be trusted. debug1: restore_uid debug1: ssh_connect: getuid 0 geteuid 0 anon 1 debug1: Connecting to 192.168.0.150 [192.168.0.150] port 22. debug1: temporarily_use_uid: 0/0 (e=0) debug1: restore_uid debug1: temporarily_use_uid: 0/0 (e=0) debug1: restore_uid debug1: Connection established. debug1: read PEM private key done: type DSA debug1: read PEM private key done: type RSA debug3: Not a RSA1 key file /root/.ssh/id_rsa. debug2: key_type_from_name: unknown key type '-----BEGIN' debug3: key_read: no key found debug2: key_type_from_name: unknown key type 'Proc-Type:' debug3: key_read: no key found debug2: key_type_from_name: unknown key type 'DEK-Info:' debug3: key_read: no key found debug3: key_read: no space debug3: key_read: no space debug3: key_read: no space debug3: key_read: no space debug3: key_read: no space debug3: key_read: no space debug3: key_read: no space debug3: key_read: no space debug3: key_read: no space debug3: key_read: no space debug3: key_read: no space debug3: key_read: no space debug3: key_read: no space debug2: key_type_from_name: unknown key type '-----END' debug3: key_read: no key found debug1: identity file /user1/.ssh/id_rsa type 1 debug1: identity file /user1/.ssh/id_dsa type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_3.1p1 debug1: match: OpenSSH_3.1p1 pat OpenSSH* Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_3.1p1 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hma...@op...,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hma...@op...,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none debug2: kex_parse_kexinit: none debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hma...@op...,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hma...@op...,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,zlib debug2: kex_parse_kexinit: none,zlib debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: mac_init: found hmac-md5 debug1: kex: server->client aes128-cbc hmac-md5 none debug2: mac_init: found hmac-md5 debug1: kex: client->server aes128-cbc hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: dh_gen_key: priv key bits set: 133/256 debug1: bits set: 1581/3191 debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug3: check_host_in_hostfile: filename /root/.ssh/known_hosts debug3: check_host_in_hostfile: match line 3 debug1: Host '192.168.X.X' is known and matches the RSA host key. debug1: Found key in /root/.ssh/known_hosts:3 debug1: bits set: 1594/3191 debug1: ssh_rsa_verify: signature correct debug1: kex_derive_keys debug1: newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: waiting for SSH2_MSG_NEWKEYS debug1: newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: done: ssh_kex2. debug1: send SSH2_MSG_SERVICE_REQUEST debug1: service_accept: ssh-userauth debug1: got SSH2_MSG_SERVICE_ACCEPT debug1: authentications that can continue: publickey,keyboard-interactive debug3: start over, passed a different list publickey,keyboard-interactive debug3: preferred publickey,keyboard-interactive,password debug3: authmethod_lookup publickey debug3: remaining preferred: keyboard-interactive,password debug3: authmethod_is_enabled publickey debug1: next auth method to try is publickey debug1: try pubkey: /user1/.ssh/id_rsa debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply debug1: input_userauth_pk_ok: pkalg ssh-rsa blen 149 lastkey 0x808fe48 hint 0 debug2: input_userauth_pk_ok: fp 05:c2:14:8a:7f:87:29:de:6d:54:35:a0:39:ae:e4:df debug3: sign_and_send_pubkey debug1: PEM_read_PrivateKey failed debug1: read PEM private key done: type <unknown> Enter passphrase for key '/user1/.ssh/id_rsa': debug1: read PEM private key done: type RSA debug1: ssh-userauth2 successful: method publickey debug3: clear hostkey 0 debug3: clear hostkey 1 debug3: clear hostkey 2 debug1: fd 4 setting O_NONBLOCK debug2: fd 5 is O_NONBLOCK debug1: channel 0: new [client-session] debug3: ssh_session2_open: channel_new: 0 debug1: send channel open 0 debug1: Entering interactive session. debug2: callback start debug1: ssh_session2_setup: id 0 debug1: Sending subsystem: sftp debug1: channel request 0: subsystem debug2: callback done debug1: channel 0: open confirm rwindow 0 rmax 32768 debug2: channel 0: rcvd adjust 131072 debug1: client_input_channel_req: channel 0 rtype exit-status reply 0 debug1: channel 0: rcvd eof debug1: channel 0: output open -> drain debug1: channel 0: obuf empty debug1: channel 0: close_write debug1: channel 0: output drain -> closed debug1: channel 0: rcvd close debug1: channel 0: close_read debug1: channel 0: input open -> closed debug3: channel 0: will not send data after close debug1: channel 0: almost dead debug1: channel 0: gc: notify user debug1: channel 0: gc: user detached debug1: channel 0: send close debug1: channel 0: is dead debug1: channel 0: garbage collecting debug1: channel_free: channel 0: client-session, nchannels 1 debug3: channel_free: status: The following connections are open: #0 client-session (t4 r0 i3/0 o3/0 fd -1/-1) debug3: channel_close_fds: channel 0: r -1 w -1 e 6 debug1: fd 0 clearing O_NONBLOCK debug2: fd 1 is not O_NONBLOCK debug1: Transferred: stdin 0, stdout 0, stderr 0 bytes in 1.5 seconds debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 0.0 debug1: Exit status 1 Connection closed Also /var/log/messages : sshd(pam_unix)[5050]: session opened for user dexgate by (uid=0) rssh[5051]: setting log facility to LOG_USER rssh[5051]: allowing sftp to all users rssh[5051]: setting umask to 022 rssh[5051]: chrooting all users to /usr/chroot/ rssh[5051]: line 25: configuring user my_user rssh[5051]: setting my_user's umask to 011 rssh[5051]: allowing sftp to user my_user rssh[5051]: chrooting my_user to /usr/chroot/home/my_user rssh[5051]: chroot cmd line: /usr/libexec/rssh_chroot_helper "/usr/chroot/home/my_user" 2 "/" /usr/libexec/openssh/sftp-server sshd(pam_unix)[5050]: session closed for user my_user This is all. What is wrong? I've tryed without chroot and sftp connection works fine, but I need chroot jail! What's the problem? Thanks _________________________________________________________________ Personalizza MSN Messenger con sfondi e fotografie! http://www.ilovemessenger.msn.it/ |
From: Derek M. <co...@pi...> - 2003-12-10 05:58:23
|
On Tue, Dec 09, 2003 at 12:18:26PM -0800, Robert Minsk wrote: [BIG SNIP] > The file > /var/spool/ftp/dir/usr/libexec/openssh/sftp-server > exists. > > What have I done wrong? Robert, I've looked at your description of what you did to set up your jail, and I don't see anything obviously wrong. However, odds are good that you've missed some important library somewhere. That is almost always the problem. Your configuration looks fine. All I can really say about it is to reiterate what I said in the CHROOT documentation: setting up a chroot jail is complicated, and very much system-dependent. So I really can't provide any better explanation as to what you may have done wrong. Ultimately, I can't support chroot jail configurations. Sorry I can't be of any more help... Derek -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Robert M. <rob...@ya...> - 2003-12-09 20:18:29
|
Some of the names in this file have been change for security reasons... Linux machine 2.4.20-13.9 #1 Mon May 12 10:55:37 EDT 2003 i686 i686 i386 GNU/Linux > rpm -qa | grep openssh openssh-clients-3.5p1-6 openssh-3.5p1-6 openssh-server-3.5p1-6 I installed rssh-2.1.1-1.RH9.i386.rpm. The entry in /etc/rssh.conf: user=hiduser:002:11:/var/spool/ftp/dir #!/bin/sh mkdir -p /var/spool/ftp/dir cd /var/spool/ftp/dir for i in /usr/bin/scp /usr/libexec/openssh/sftp-server /usr/libexec/rssh_chroot_helper; do tar -cBf - $i | tar -xBvf - tar -cBf - `ldd $i | awk '{ print $3 }'` | tar -xBvf - done tar -cBf - /etc/passwd /etc/ld.so* /lib/libnss_files.so.? | tar -xBvf - mkdir dev When I try to sftp to the machine I get: Dec 3 21:11:39 machine sshd(pam_unix)[7748]: session opened for user hiduser by (uid=3004) Dec 3 21:11:39 machine rssh[7749]: setting log facility to LOG_USER Dec 3 21:11:39 machine rssh[7749]: setting umask to 022 Dec 3 21:11:39 machine rssh[7749]: line 41: configuring user hiduser Dec 3 21:11:39 machine rssh[7749]: setting hiduser's umask to 02 Dec 3 21:11:39 machine rssh[7749]: allowing scp to user hiduser Dec 3 21:11:39 machine rssh[7749]: allowing sftp to user hiduser Dec 3 21:11:39 machine rssh[7749]: chrooting hiduser to /var/spool/ftp/dir Dec 3 21:11:39 machine rssh[7749]: chroot cmd line: /usr/libexec/rssh_chroot_helper "/var/spool/ftp/dir" 2 "/" /usr/libexec/openssh/sftp-server Dec 3 21:11:39 machine sshd(pam_unix)[7748]: session closed for user hiduser Dec 4 05:11:39 machine rssh_chroot_helper[7749]: new session for hiduser, UID=3004 Dec 4 05:11:39 machine rssh_chroot_helper[7749]: execv() failed, /usr/libexec/openssh/sftp-server: No such file or directory The file /var/spool/ftp/dir/usr/libexec/openssh/sftp-server exists. What have I done wrong? __________________________________ Do you Yahoo!? New Yahoo! Photos - easier uploading and sharing. http://photos.yahoo.com/ |
From: Robert M. <rob...@ya...> - 2003-12-04 04:37:52
|
Some of the names in this file have been change for security reasons... Linux machine 2.4.20-13.9 #1 Mon May 12 10:55:37 EDT 2003 i686 i686 i386 GNU/Linux > rpm -qa | grep openssh openssh-clients-3.5p1-6 openssh-3.5p1-6 openssh-server-3.5p1-6 I installed rssh-2.1.1-1.RH9.i386.rpm. The entry in /etc/rssh.conf: user=hiduser:002:11:/var/spool/ftp/dir #!/bin/sh mkdir -p /var/spool/ftp/dir cd /var/spool/ftp/dir for i in /usr/bin/scp /usr/libexec/openssh/sftp-server /usr/libexec/rssh_chroot_helper; do tar -cBf - $i | tar -xBvf - tar -cBf - `ldd $i | awk '{ print $3 }'` | tar -xBvf - done tar -cBf - /etc/passwd /etc/ld.so* /lib/libnss_files.so.? | tar -xBvf - mkdir dev When I try to sftp to the machine I get: Dec 3 21:11:39 machine sshd(pam_unix)[7748]: session opened for user hiduser by (uid=3004) Dec 3 21:11:39 machine rssh[7749]: setting log facility to LOG_USER Dec 3 21:11:39 machine rssh[7749]: setting umask to 022 Dec 3 21:11:39 machine rssh[7749]: line 41: configuring user hiduser Dec 3 21:11:39 machine rssh[7749]: setting hiduser's umask to 02 Dec 3 21:11:39 machine rssh[7749]: allowing scp to user hiduser Dec 3 21:11:39 machine rssh[7749]: allowing sftp to user hiduser Dec 3 21:11:39 machine rssh[7749]: chrooting hiduser to /var/spool/ftp/dir Dec 3 21:11:39 machine rssh[7749]: chroot cmd line: /usr/libexec/rssh_chroot_helper "/var/spool/ftp/dir" 2 "/" /usr/libexec/openssh/sftp-server Dec 3 21:11:39 machine sshd(pam_unix)[7748]: session closed for user hiduser Dec 4 05:11:39 machine rssh_chroot_helper[7749]: new session for hiduser, UID=3004 Dec 4 05:11:39 machine rssh_chroot_helper[7749]: execv() failed, /usr/libexec/openssh/sftp-server: No such file or directory The file /var/spool/ftp/dir/usr/libexec/openssh/sftp-server exists. What have I done wrong? __________________________________ Do you Yahoo!? Free Pop-Up Blocker - Get it now http://companion.yahoo.com/ |
From: Jose M.H. <jhe...@in...> - 2003-11-27 18:29:08
|
I have: allowsftp chrootpath="/usr/chroot" Now... the chroot run perfect, but I don't understand why not run, the follow syntaxis: user=test:011:11:"/usr/chroot /usr/chroot/jotin" Thanks for your help... |