rssh-discuss Mailing List for rssh (Page 32)
Brought to you by:
xystrus
You can subscribe to this list here.
2003 |
Jan
|
Feb
|
Mar
|
Apr
|
May
(4) |
Jun
(1) |
Jul
(15) |
Aug
(33) |
Sep
(5) |
Oct
(15) |
Nov
(8) |
Dec
(4) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2004 |
Jan
(5) |
Feb
|
Mar
(5) |
Apr
(4) |
May
(4) |
Jun
(15) |
Jul
(9) |
Aug
(11) |
Sep
(5) |
Oct
(2) |
Nov
|
Dec
(6) |
2005 |
Jan
(8) |
Feb
(6) |
Mar
(43) |
Apr
(2) |
May
(5) |
Jun
(6) |
Jul
(12) |
Aug
(22) |
Sep
(5) |
Oct
(7) |
Nov
(15) |
Dec
(5) |
2006 |
Jan
(60) |
Feb
(7) |
Mar
(12) |
Apr
(7) |
May
(5) |
Jun
(14) |
Jul
(19) |
Aug
(21) |
Sep
(16) |
Oct
(2) |
Nov
(15) |
Dec
(3) |
2007 |
Jan
|
Feb
|
Mar
|
Apr
(24) |
May
|
Jun
(26) |
Jul
(12) |
Aug
(1) |
Sep
(7) |
Oct
(2) |
Nov
|
Dec
(1) |
2008 |
Jan
(4) |
Feb
(6) |
Mar
(4) |
Apr
(4) |
May
(5) |
Jun
(4) |
Jul
(4) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
2009 |
Jan
|
Feb
(27) |
Mar
(20) |
Apr
(8) |
May
(1) |
Jun
(1) |
Jul
|
Aug
(3) |
Sep
(2) |
Oct
(1) |
Nov
|
Dec
|
2010 |
Jan
(3) |
Feb
(1) |
Mar
(3) |
Apr
|
May
|
Jun
(4) |
Jul
(7) |
Aug
(6) |
Sep
(7) |
Oct
(1) |
Nov
|
Dec
|
2011 |
Jan
|
Feb
(5) |
Mar
(5) |
Apr
(16) |
May
|
Jun
(6) |
Jul
(20) |
Aug
(10) |
Sep
(4) |
Oct
|
Nov
|
Dec
(7) |
2012 |
Jan
(5) |
Feb
|
Mar
(9) |
Apr
|
May
(6) |
Jun
(3) |
Jul
(1) |
Aug
|
Sep
|
Oct
(1) |
Nov
(5) |
Dec
(6) |
2013 |
Jan
|
Feb
|
Mar
(5) |
Apr
|
May
|
Jun
|
Jul
(2) |
Aug
(2) |
Sep
(3) |
Oct
(1) |
Nov
(1) |
Dec
|
2014 |
Jan
(5) |
Feb
|
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
(7) |
Sep
|
Oct
|
Nov
|
Dec
|
2015 |
Jan
|
Feb
|
Mar
|
Apr
(4) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(2) |
Nov
(7) |
Dec
|
2016 |
Jan
|
Feb
|
Mar
(4) |
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(11) |
Nov
|
Dec
|
2018 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
(2) |
2019 |
Jan
(8) |
Feb
(17) |
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(3) |
Dec
|
2020 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(1) |
Dec
|
2021 |
Jan
(4) |
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
2022 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(1) |
Nov
|
Dec
|
From: Jose M.H. <jhe...@in...> - 2003-11-27 14:01:05
|
Please where I can find a example of rssh.conf... I try to understand this but always throws an error... Thanks! |
From: Anthony R. <ar...@am...> - 2003-11-21 15:51:14
|
Hello, I've been fiddling with rssh and jailed sftp access for over a day and I'm stumped trying to figure out why my test login can successfully log in just to be bumped back out. I'm probably missing something obvious and hopefully somebody may be able to point out my problem. There are two flavours I'm installing this on; Redhat 8 and another derived from Debian. The Debian system was simple to setup, jail working an all. Not so good for Redhat though. I've listed the jail below. The test account has been created, it's home directory set to the jail directory (clients) and rssh set as the shell. I've updated syslogd as well to accept from clients/dev/log in hopes of catching the problem, but I don't see the issue. I've included it below as well. I appreciate any help or advice provided. CHROOT JAIL /clients /clients/beta /clients/release /clients/global /clients/bin /clients/bin/sh /clients/lib /clients/lib/libtermcap.so.2 /clients/lib/libdl.so.2 /clients/lib/libc.so.6 /clients/lib/ld-linux.so.2 /clients/lib/libresolv.so.2 /clients/lib/libutil.so.1 /clients/lib/libnsl.so.1 /clients/lib/libcrypto.so.2 /clients/usr /clients/usr/libexec /clients/usr/libexec/openssh /clients/usr/libexec/openssh/sftp-server /clients/usr/libexec/rssh_chroot_helper /clients/usr/lib /clients/usr/lib/libz.so.1 /clients/usr/kerberos /clients/usr/kerberos/lib /clients/usr/kerberos/lib/libk5crypto.so.3 /clients/usr/kerberos/lib/libcom_err.so.3 /clients/usr/kerberos/lib/libkrb5.so.3 /clients/usr/bin /clients/usr/bin/scp /clients/etc /clients/etc/passwd /clients/dev /clients/dev/log SYSTEM LOG Nov 21 10:28:26 hostname sshd(pam_unix)[5338]: session opened for user beta by (uid=525) Nov 21 10:28:26 hostname rssh[5339]: setting log facility to LOG_USER Nov 21 10:28:26 hostname rssh[5339]: allowing sftp to all users Nov 21 10:28:26 hostname rssh[5339]: setting umask to 022 Nov 21 10:28:26 hostname rssh[5339]: chrooting all users to /clients Nov 21 10:28:26 hostname rssh[5339]: chroot cmd line: /usr/libexec/rssh_chroot_helper "/clients" 2 "/" /usr/libexec/openssh/sftp-server Nov 21 15:28:26 hostname rssh_chroot_helper[5339]: new session for unknown user, UID=525 Nov 21 10:28:26 hostname sshd(pam_unix)[5338]: session closed for user beta -- *Anthony Rabaa* Software Developer AMCon Research Inc., Ottawa, Ontario, Canada http://www.amconresearch.com |
From: Melissa Y. <the...@ya...> - 2003-11-13 15:50:25
|
Hello, The problem is that I can not use scp to copy files from one system to another which is using rssh. System 1 /etc/passwd: tester1:x:1001:9999::/home/test/tester1:/usr/local/bin/rssh System 1 /etc/group: sshusers::9999:tester1 System 2 /etc/passwd: tester1:x:1001:9999::/home/tester1:/bin/sh System 2 /etc/group: sshusers::9999:tester1,tester2 rssh is installed on System 1. sftp is tested fine, so chroot is fine. Here is the rssh.conf: allowscp allowsftp umask = 022 user=tester1:011:01:/home/test/tester1 I login system 2 as tester1, and got the following result: system2$ scp testfile system1:/home/test/tester1/. tester1@ftpsrv's password: /home/test/tester1: 1 is not an executable file, or /usr/local/libexec/rssh_chroot_helperunknown user 1001 lost connection I really dont have a clue on what this error message means. Please help! Thank you! __________________________________ Do you Yahoo!? Protect your identity with Yahoo! Mail AddressGuard http://antispam.yahoo.com/whatsnewfree |
From: Derek M. <co...@pi...> - 2003-11-07 06:32:46
|
On Fri, Oct 31, 2003 at 02:30:43PM -0800, Melissa Young wrote: > Hello, Derek: How are you doing? Pretty well, thanks, but busy all the time... > I now have a quick question: I like to setup rssh for > two users who will enter his own directory. To do > this, I need to separately build two independent > chroot fails, right? Yes. But be careful about this. For two or three users, this isn't too bad, but for more than that it will become troublesome. There are notes about that in the CHROOT file... > My question is if the following rssh.conf file is > correct: > > # cat rssh.conf > > allowsftp > umask = 022 > chrootpath=/home/rsshtest > > user=rsshtester1:011:10:/home/rsshtest/rsshtester1 > user=rsshtester2:011:10:/home/rsshtest/rsshtester2 Sure, it looks fine. Though, if you aren't doing any other chrooting than just these two users, you don't actually need the chrootpath= line. If you want other users to log in normally, you probably want to get rid of that. -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Derek M. <co...@pi...> - 2003-11-07 06:25:04
|
On Mon, Nov 03, 2003 at 02:31:16PM +0000, Matthew Claridge wrote: > ok, I've fixed the problem below, by copying all the libraries again - > must have missed something.... > anyway, I'm at the stage now where I can connect and the > rssh_chroot_helper is doing its bit, but the connection then drops. > The following is logged by ssh: Based on the log output you give (below), I'd have to disagree: rssh_chroot_helper is not running. Or at the very least, you don't have logging set up correctly. > [2801]: setting log facility to LOG_USER > [2801]: allowing scp to all users > [2801]: allowing sftp to all users > [2801]: setting umask to 022 > [2801]: chrooting all users to /usr/chroot > [2801]: line 32: configuring user test1 > [2801]: setting test1's umask to 022 > [2801]: allowing scp to user test1 > [2801]: allowing sftp to user test1 > [2801]: chrooting test1 to /usr/chroot/home/test1 > [2801]: chroot cmd line: /usr/local/libexec/rssh_chroot_helper > "/usr/chroot/home/test1" 2 "/" /usr/libexec/openssh/sftp-server > [2800]: session closed for user test1 There's no session log from the chroot helper. This is a sure sign that your jail is not set up correctly. Unfortunately, there's no way for me to guess what you've missed. All of the steps for setting it up are essential, and missing any of them, or even a single library, produces the same exact result: the chroot helper dies without doing anything useful. Hope that helps. -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Matthew C. <mcl...@rw...> - 2003-11-03 14:30:33
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"> <title></title> </head> <body text="#000000" bgcolor="#ffffff"> ok, I've fixed the problem below, by copying all the libraries again - must have missed something....<br> <br> anyway, I'm at the stage now where I can connect and the rssh_chroot_helper is doing its bit, but the connection then drops. The following is logged by ssh:<br> <br> [2801]: setting log facility to LOG_USER<br> [2801]: allowing scp to all users<br> [2801]: allowing sftp to all users<br> [2801]: setting umask to 022<br> [2801]: chrooting all users to /usr/chroot<br> [2801]: line 32: configuring user test1<br> [2801]: setting test1's umask to 022<br> [2801]: allowing scp to user test1<br> [2801]: allowing sftp to user test1<br> [2801]: chrooting test1 to /usr/chroot/home/test1<br> [2801]: chroot cmd line: /usr/local/libexec/rssh_chroot_helper "/usr/chroot/home/test1" 2 "/" /usr/libexec/openssh/sftp-server<br> [2800]: session closed for user test1<br> <br> <br> and I get the following logged by FileZilla:<br> <br> Status: Connected with mickey:22, initializing SFTP connection...<br> Command: CONNECT test1@mickey:22<br> Response: Fatal: unable to initialise SFTP: could not connect<br> Error: Unable to connect!<br> <br> <br> any ideas anyone?<br> <br> thanks<br> Matt<br> -------- Original Message -------- <table border="0" cellspacing="0" cellpadding="0"> <tbody> <tr> <th nowrap="nowrap" align="right" valign="baseline">Subject: </th> <td>rssh and RedHat authentication problem</td> </tr> <tr> <th nowrap="nowrap" align="right" valign="baseline">Date: </th> <td>3 Nov 2003 12:54:32 +0000</td> </tr> <tr> <th nowrap="nowrap" align="right" valign="baseline">From: </th> <td>Matthew Claridge <a class="moz-txt-link-rfc2396E" href="mailto:mcl...@rw..."><mcl...@rw...></a></td> </tr> <tr> <th nowrap="nowrap" align="right" valign="baseline">Organization: </th> <td>RWA Limited</td> </tr> <tr> <th nowrap="nowrap" align="right" valign="baseline">To: </th> <td><a class="moz-txt-link-abbreviated" href="mailto:rss...@li...">rss...@li...</a></td> </tr> </tbody> </table> <br> <br> <pre>Hi, I've installed rssh on a RH9 system and now I'm setting up a chroot environment for it. I've read and followed the instructions in the CHROOT document, but I'm getting errors when logging in via ssh/scp: sshd(pam_unix)[25510]: check pass; user unknown sshd(pam_unix)[25510]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser=rhost=marvin.rwa-net.co.uk I'm assuming there are some libraries missing somewhere but am unsure how to find out which ones since I've copied the libnss files which I know are required..... If anyone has anu suggestions, I'd be most grateful.... cheers Matt </pre> <br> <div class="moz-signature">-- <br> <table width="300" border="0"> <tbody> <tr> <td><font color="#4545ab"><b>Matthew Claridge</b></font></td> </tr> <tr> <td><font color="#5757bb">Product Support Engineer<br> RWA Limited<br> Direct line: 02920 815 054<br> Email: <a class="moz-txt-link-abbreviated" href="mailto:mcl...@rw...">mcl...@rw...</a><br> Web: <a class="moz-txt-link-abbreviated" href="http://www.rwa-net.co.uk">www.rwa-net.co.uk</a></font></td> </tr> </tbody> </table> </div> </body> </html> |
From: Matthew C. <mcl...@rw...> - 2003-11-03 12:54:01
|
Hi, I've installed rssh on a RH9 system and now I'm setting up a chroot environment for it. I've read and followed the instructions in the CHROOT document, but I'm getting errors when logging in via ssh/scp: sshd(pam_unix)[25510]: check pass; user unknown sshd(pam_unix)[25510]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser=rhost=marvin.rwa-net.co.uk I'm assuming there are some libraries missing somewhere but am unsure how to find out which ones since I've copied the libnss files which I know are required..... If anyone has anu suggestions, I'd be most grateful.... cheers Matt |
From: Melissa Y. <the...@ya...> - 2003-10-31 22:30:45
|
Hello, Derek: How are you doing? I now have a quick question: I like to setup rssh for two users who will enter his own directory. To do this, I need to separately build two independent chroot fails, right? My question is if the following rssh.conf file is correct: # cat rssh.conf allowsftp umask = 022 chrootpath=/home/rsshtest user=rsshtester1:011:10:/home/rsshtest/rsshtester1 user=rsshtester2:011:10:/home/rsshtest/rsshtester2 Thank you! Melissa Young System Admin __________________________________ Do you Yahoo!? Exclusive Video Premiere - Britney Spears http://launch.yahoo.com/promos/britneyspears/ |
From: Jeff <rs...@pr...> - 2003-10-26 12:18:33
|
All, Problem solved, thought I would post the outcome FYI in case someone = else encounters the same issue. Basically, it appeared to be an = inconsistency in the way sftp takes options. If you check the sftp man page, it says it can take normal ssh options = (as used in ssh_config) using the "-o" switch. It also accepts "-1" as a = switch to use protocol version 1 (which is what I needed with the RSA1 keys). Here's the oddity - using "-1" appears to be quite different to using "-oProtocol=3D1" when using sftp, although both are happily accepted. = When using interactive login (username/password), both methods work just = fine. However, when using keys, "-1" works while "-oProtocol=3D1" results in = the sftp unauthorised commands error I described previously. There may be an obvious reason why this is the case, but I couldn't find = it anywhere. It's a subtle quirk that drove me crazy - hopefully no-one = else will have the same problem and not be able to find the solution!! Cheers Jeff |
From: Jeff <rs...@pr...> - 2003-10-25 09:02:38
|
Help - I've come 98% of the way and I've hit a wall!! For background = (and to highlight that I have actually played with this stuff), I have users happily logging in to chrooted environments, sftp works a treat as do = the individual configs in rssh.conf. Uploads/downloads all working nicely = as well. However, all is not well in paradise - I have one user who accesses my = sftp server using scripts, and therefore wants to use passphrase-less RSA1 = keys (I know, don't start on me about the security implications!!). "No = probs" I think to myself - install the key in his "authorized_keys" file, do a = test and to my surprise get the following (names/dates removed): Sshd(pam_unix): authentication failure; logname=3D uid=3D0 euid=3D0 = tty=3DNODEVssh ruser=3D rhost=3D<myhostname> user=3D<username> Sshd(pam_unix): session opened for user <username> by (uid=3D500) Rssh: setting log facility to LOG_USER Rssh: line 42: configuring user <username> Rssh: setting <username's> umask to 011 Rssh: allowing sftp to user <username> Rssh: chrooting <username> to /home/<username> Rssh: user <username> attempted to execute forbidden commands Rssh: command: sftp Sshd)pam_unix): session closed for user <username> Now, I've played quite a bit with ssh, so the thing that has me baffled = is that although pam says authentication failed, it still allows me to = proceed. Only later do I get thrown out due to the forbidden command error. From = the client side, the user is presented with the standard "This account is restricted to sftp...etc" error Can anyone see what I've missed??? It's driving me nuts because this = user's account and access works fine in interactive (ie username/password) mode = but throws up all over itself as soon as I introduce keys... I was not able = to find any info in my research to indicate any special problems with keys = - has anyone else got keys working? I appreciate ANY insight!! Jeff {8^) (BTW, apologies for a partial previous post, my mailer freaked = mid-typing and killed a previous version of this!) |
From: Jeff <rs...@pr...> - 2003-10-25 08:25:36
|
Help! I've travelled 98% of the journey, only to get hit at the last = turn!! For background, chroot works a treat, sftp working no problems with = rssh, and users can happily log in and wander around their (chroot'd) homes. = File uploads/downloads also going fine. However, I have one instance where the user login is automated (in = scripts), and therefore the user wants to use a passphrase-less RSA1 key (I know, don't start on me with the security implications!!). Anyway, I install = the key on the server (in their authorized_keys file), and do some tests. Here's what I get (in /var/log/messages - dates/times/names removed for sanity): Sshd(pam_unix): authentication failure; logname=3D uid=3D0 euid=3D0 = tty=3DNODEVssh ruser=3D ruser=3D<myhostname> user=3D<username> Sshd(pam_unix): session opened for user <username> by (uid=3D500) Rssh: setting log facility to LOG_USER Rssh: line 42: configuring user <username> Rssh: setting <username's> umask to 011 Rssh: allowing sftp to user <username> Rssh: chrooting <username> to /home/<username> Rssh: user <username> attempted to execute forbidden commands Rssh: command: sftp Sshd(pam_unix): session closed for user < |
From: Derek M. <co...@pi...> - 2003-10-24 04:35:53
|
On Wed, Oct 22, 2003 at 12:16:16PM -0700, Ajay Sharma wrote: > If the local file is 600 and you upload it then the file on the server > will remain 600. Bad. This can not be fixed in rssh. It is a function of the client you are using copying the file with the permissions it already has. It is not possible to make rssh override those permissions. Sorry. -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Ajay S. <ss...@am...> - 2003-10-24 04:00:17
|
I'm playing around with the umask and it seems like it's only applied on the files that it only reduces permissions and it won't increase them. Example: The umask is 022, the local file is 777, when you upload it, the file will become 755 on the server. Good! If the local file is 600 and you upload it then the file on the server will remain 600. Bad. I want to force the file to be group writable with a umask of 002 but this won't work if people are keeping their local files 600. Some output of what I'm talking about is below, I've also include the log entries so that you can see that the umask is being set correctly: Good: [ssharma@ajay ssharma]$ chmod 0777 test.sql [ssharma@ajay ssharma]$ ls -l test.sql -rwxrwxrwx 1 ssharma ssharma 38356 Apr 24 11:14 test.sql [ssharma@ajay ssharma]$ sftp us...@ho... Connecting to host.amntv.com... us...@ho...'s password: sftp> put test.sql Uploading test.sql to /home/user/test.sql sftp> ls -rwxr-xr-x 0 1000 1000 38356 Oct 22 11:50 test.sql sftp> Bad: [ssharma@ajay ssharma]$ ls -l test.sql -rw------- 1 ssharma ssharma 38356 Apr 24 11:14 test.sql [ssharma@ajay ssharma]$ sftp us...@ho... Connecting to host.amntv.com... us...@ho...'s password: sftp> put test.sql Uploading test.sql to /home/fosdick/test.sql sftp> ls -l test.sql -rw------- 0 1000 1000 38356 Oct 22 11:49 test.sql And here's what a connection looks like in the log: Oct 22 11:49:08 host sshd(pam_unix)[18646]: session opened for user user by (uid=1000) Oct 22 11:49:08 host rssh[18647]: setting log facility to LOG_USER Oct 22 11:49:08 host rssh[18647]: allowing scp to all users Oct 22 11:49:08 host rssh[18647]: allowing sftp to all users Oct 22 11:49:08 host rssh[18647]: setting umask to 022 Oct 22 11:49:08 host rssh[18647]: line 40: configuring user user Oct 22 11:49:08 host rssh[18647]: setting user's umask to 022 Oct 22 11:49:08 host rssh[18647]: allowing scp to user user Oct 22 11:49:08 host rssh[18647]: allowing sftp to user user Oct 22 11:49:08 host rssh[18647]: chrooting user to /var/www/clients.amntv.com/chroot/ Oct 22 11:49:08 host rssh[18647]: chroot cmd line: /usr/libexec/rssh_chroot_helper "/var/www/clients.amntv.com/chroot" 2 "/home/user" /usr/libexec/openssh/sftp-server Oct 22 18:49:08 host rssh_chroot_helper[18647]: new session for user, UID=1000 Oct 22 11:49:25 host sshd(pam_unix)[18646]: session closed for user user If this is the way that umask is supposed to work then please correct me. I'm certainly no unix expert so I could very well be wrong. Thanks, Ajay |
From: Laurent M. <Lau...@ma...> - 2003-10-22 11:27:42
|
Derek Martin a écrit : > Secondly, any true SFTP program *should* work with rssh, but in > practice some don't because they try to do things they shouldn't do. > For example, gftp can do sftp, but it tries to execute commmands on > the remote host which rssh will not allow (in this case, "echo") and > therefore fails. > Derek, gftp works fine in a chrooted environment if you select Use SFTP SSH2 subsys in FTP/Options/SSH Winscp 3 and filezilla work OK if you select SFTP protocol. Laurent |
From: Maxim A. <m.a...@eq...> - 2003-10-21 10:06:26
|
Hi, I've installed rssh typicaly, created test user test3 cat /etc/passwd ... test3:x:101:102::/home/test3:/bin/bash as was written in SECURITY, test3 user is not an owner of /home/test3 dir(nor .ssh dir in it) i've owned /home/test3 to root.test -R where test is a group that includes user test3, but test is allowed to read only for that dir. copied to /home/test3/.ssh/authorized_keys public key from remote client and tested if it is working... from client machine: /usr/local/openssh/bin/scp -S /usr/local/openssh/bin/ssh test3@SERVER_IP_ADDRESS:/test /tmp/ test 100% 4 0.0KB/s 00:00 file test is exist both in / and in future /chrootdir changed line in /etc/passwd test3:x:101:102::/home/test3:/usr/local/bin/rssh changed /usr/local/etc/rssh.conf user=test3:101:11:"/test3" created a chrootdir, caled /test3, as i've used prefix(=/usr/local/openssh-3.7p1) to configure openssh, i've copied: /test3/usr/local/openssh-3.7p1/bin/scp (and all libs to their folder relative to /test3) /test3/usr/local/openssh-3.7p1/libexec/sftp-server (and all libs to their folder relative to /test3) and /test3/usr/local/libexec/rssh_chroot_helper (default, linked staticaly) from client machine trying to copy file with the same command nothing... adding -v option for scp and see the debug: OpenSSH_3.7p1, SSH protocols 1.5/2.0, OpenSSL 0.9.7b 10 Apr 2003 ... (previous debug line is ok) debug1: Sending command: scp -v -f /test debug1: client_input_channel_req: channel 0 rtype exit-status reply 0 debug1: channel 0: free: client-session, nchannels 1 debug1: fd 0 clearing O_NONBLOCK debug1: fd 1 clearing O_NONBLOCK debug1: Transferred: stdin 0, stdout 0, stderr 0 bytes in 0.1 seconds debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 0.0 debug1: Exit status 1 at server cat /var/log/messages Oct 21 13:20:18 ares sshd[13727]: Accepted publickey for test3 from CLIENT_IP_ADDRESS port 2906 ssh2 Oct 21 13:20:18 ares rssh[13730]: setting log facility to LOG_USER Oct 21 13:20:18 ares rssh[13730]: setting umask to 022 Oct 21 13:20:18 ares rssh[13730]: line 37: configuring user test3 Oct 21 13:20:18 ares rssh[13730]: setting test3's umask to 0101 Oct 21 13:20:18 ares rssh[13730]: allowing scp to user test3 Oct 21 13:20:18 ares rssh[13730]: allowing sftp to user test3 Oct 21 13:20:18 ares rssh[13730]: chrooting test3 to /test3 Oct 21 13:20:18 ares rssh[13730]: chroot cmd line: /usr/local/libexec/rssh_chroot_helper "/test3" 1 "/" scp -v -f /test here i don't know what to do.... -- Maxim N. Areschenko &Equant, Russia e-mail: m.a...@eq... Phone: +7-095-9299500 (int: 5476) |
From: Derek M. <co...@pi...> - 2003-10-21 06:36:20
|
On Sun, Oct 19, 2003 at 04:19:52PM -0400, Joaquim Laureano wrote: > Hi, > > I have installed rssh, and am being unable to make the "chroot" > process work. As far as I can see, I follow the config file > instructions, but it fails to work. I am using RedHat 9.0 and > "chroot" is located in "/usr/sbin". I even copied "chroot" to > "/usr/local", but it still fails I have no idea where you got that idea, but rssh does not need and does not use the chroot command. It does its own chrooting. What you have done is to set the location of the directory into which you will chroot users to "/usr/sbin/chroot /home/usr00020" -- a path that almost certainly does not exist on your system. Hence the stat() failed message. Please re-read the man page for rssh.conf(5) and the README and CHROOT files in the source distribution. Or, if you downloaded the RPMs, look in /usr/share/doc/rssh* for those files. -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Derek M. <co...@pi...> - 2003-10-21 06:17:44
|
On Wed, Oct 15, 2003 at 03:58:40PM -0500, Aaron Axelsen wrote: > Do I need a specific program to connect from a windows machine to scponly > shell? Or will any SFTP program work? First, scponly is a different shell than rssh. If you're not using rssh, then any answer I give you will not be valid. If you want info about scponly, go here: http://www.sublimation.org/scponly/ Secondly, any true SFTP program *should* work with rssh, but in practice some don't because they try to do things they shouldn't do. For example, gftp can do sftp, but it tries to execute commmands on the remote host which rssh will not allow (in this case, "echo") and therefore fails. Any sftp client which ONLY tries to do sftp will work fine. If you look at the FAQ on the website, some examples that will work are given. -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Joaquim L. <lau...@lu...> - 2003-10-21 00:09:34
|
-----Forwarded Message----- > From: Joaquim Laureano <lau...@lu...> > To: rss...@li... > Subject: stat() failed, /usr/sbin/chroot /home/usr00020: > Date: Sun, 19 Oct 2003 16:19:52 -0400 > > Hi, > > I have installed rssh, and am being unable to make the "chroot" process > work. As far as I can see, I follow the config file instructions, but > it fails to work. I am using RedHat 9.0 and "chroot" is located in > "/usr/sbin". I even copied "chroot" to "/usr/local", but it still fails > to work. "chroot" works if I use it in a command line as root. And I > can sftp to the account if I remove the "chroot" step from the user > configuration line. I will appreciate your help. Below I provide the > log and config data. > > > ------------------- log data -------------------------------- > > Oct 19 15:36:20 tyan2100fe sshd(pam_unix)[6096]: session opened for user > usr00020 by (uid=511) > Oct 19 15:36:20 tyan2100fe rssh[6097]: setting log facility to LOG_USER > Oct 19 15:36:20 tyan2100fe rssh[6097]: setting umask to 027 > Oct 19 15:36:20 tyan2100fe rssh[6097]: line 40: configuring user usr00020 > Oct 19 15:36:20 tyan2100fe rssh[6097]: setting usr00020's umask to 022 > Oct 19 15:36:20 tyan2100fe rssh[6097]: allowing scp to user usr00020 > Oct 19 15:36:20 tyan2100fe rssh[6097]: allowing sftp to user usr00020 > Oct 19 15:36:20 tyan2100fe rssh[6097]: chrooting usr00020 to > /usr/sbin/chroot /home/usr00020 > Oct 19 15:36:20 tyan2100fe rssh[6097]: chroot cmd line: > /usr/libexec/rssh_chroot_helper "/usr/sbin/chroot /home/usr00020" 2 "/" > /usr/libexec/openssh/sftp-server > Oct 19 15:36:20 tyan2100fe rssh_chroot_helper[6097]: new session for > usr00020, UID=511 > Oct 19 15:36:20 tyan2100fe rssh_chroot_helper[6097]: stat() failed, > /usr/sbin/chroot /home/usr00020: No such file or directory > Oct 19 15:36:20 tyan2100fe sshd(pam_unix)[6096]: session closed for user > usr00020 > > ------------------- partial config data -------------------------- > > # if you want to chroot users, use this to set the directory > # if you DO NOT want to chroot users, LEAVE THIS COMMENTED OUT. > # Quotes not required unless path contains a space... > #chrootpath="/usr/sbin/chroot /tmp" > > # non-quoted spaces don't matter, so long as they aren't in the middle > # of a token (like a keyword) > #user = "rudy:011:01:/usr/local/chroot dir" > user=usr00020:022:11:"/usr/sbin/chroot /home/usr00020" -- Joaquim Laureano Lusostar Technologies, LLC 291 Old Deal Road Eatontown, NJ 07724 Phone: 732-542-4890 Email: lau...@lu... |
From: Joaquim L. <lau...@lu...> - 2003-10-19 21:59:42
|
Hi, I have installed rssh, and am being unable to make the "chroot" process work. As far as I can see, I follow the config file instructions, but it fails to work. I am using RedHat 9.0 and "chroot" is located in "/usr/sbin". I even copied "chroot" to "/usr/local", but it still fails to work. "chroot" works if I use it in a command line as root. And I can sftp to the account if I remove the "chroot" step from the user configuration line. I will appreciate your help. Below I provide the log and config data. ------------------- log data -------------------------------- Oct 19 15:36:20 tyan2100fe sshd(pam_unix)[6096]: session opened for user usr00020 by (uid=511) Oct 19 15:36:20 tyan2100fe rssh[6097]: setting log facility to LOG_USER Oct 19 15:36:20 tyan2100fe rssh[6097]: setting umask to 027 Oct 19 15:36:20 tyan2100fe rssh[6097]: line 40: configuring user usr00020 Oct 19 15:36:20 tyan2100fe rssh[6097]: setting usr00020's umask to 022 Oct 19 15:36:20 tyan2100fe rssh[6097]: allowing scp to user usr00020 Oct 19 15:36:20 tyan2100fe rssh[6097]: allowing sftp to user usr00020 Oct 19 15:36:20 tyan2100fe rssh[6097]: chrooting usr00020 to /usr/sbin/chroot /home/usr00020 Oct 19 15:36:20 tyan2100fe rssh[6097]: chroot cmd line: /usr/libexec/rssh_chroot_helper "/usr/sbin/chroot /home/usr00020" 2 "/" /usr/libexec/openssh/sftp-server Oct 19 15:36:20 tyan2100fe rssh_chroot_helper[6097]: new session for usr00020, UID=511 Oct 19 15:36:20 tyan2100fe rssh_chroot_helper[6097]: stat() failed, /usr/sbin/chroot /home/usr00020: No such file or directory Oct 19 15:36:20 tyan2100fe sshd(pam_unix)[6096]: session closed for user usr00020 ------------------- partial config data -------------------------- # if you want to chroot users, use this to set the directory # if you DO NOT want to chroot users, LEAVE THIS COMMENTED OUT. # Quotes not required unless path contains a space... #chrootpath="/usr/sbin/chroot /tmp" # non-quoted spaces don't matter, so long as they aren't in the middle # of a token (like a keyword) #user = "rudy:011:01:/usr/local/chroot dir" user=usr00020:022:11:"/usr/sbin/chroot /home/usr00020" -- Joaquim Laureano Lusostar Technologies, LLC 291 Old Deal Road Eatontown, NJ 07724 Phone: 732-542-4890 Email: lau...@lu... |
From: Aaron A. <lt...@fr...> - 2003-10-15 20:58:52
|
Do I need a specific program to connect from a windows machine to scponly shell? Or will any SFTP program work? --- Aaron Axelsen Learning Technology Center UW - Whitewater |
From: Derek M. <co...@pi...> - 2003-10-15 05:50:19
|
On Tue, Oct 14, 2003 at 02:47:54PM -0500, Aaron Axelsen wrote: > I stumbled accross RSSH and it looked like it could solve all my > issues. We are trying to set up an enviroment with sftp allowing > users to be chrooted to their home account so they cannot go > snooping around other locations on the system. It is possible to do this, but I don't recommend that, at least not exactly. The documentation explains why, so I won't reiterate it here. It is better to create ONE chroot jail for all your users, and then limit users' access to directories based on Unix file permissions. This is almost as good for your purposes, and much more managable. > If i understand correctly, that is one of the features of RSSH. Is > this a fairly simple processes to implement and updated via RPM's? No. Setting up a chroot jail is complicated. The documentation explains how to do it, but the exact steps are system-dependent, so there is not (and never can be) a concise step-by-step procedure to set it up. But if you have ever successfully set up complicated software in the past, you should be able to follow the directions and get it working. > Also, will redhats openssh rpm updates in any way cause problems with rssh > once it is installed and configured? No, updates will not cause problems (unless they are buggy of course). But, when you create a chroot jail, you will need to copy some of the OpenSSH files into the jail. When you update, you will need to copy the new versions of any files you copied before into the jail. Caveat sysadmin... > Thanks in advance for comments. You're welcome! -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
From: Aaron A. <lt...@fr...> - 2003-10-14 19:47:56
|
Greetings, I stumbled accross RSSH and it looked like it could solve all my issues. We are trying to set up an enviroment with sftp allowing users to be chrooted to their home account so they cannot go snooping around other locations on the system. If i understand correctly, that is one of the features of RSSH. Is this a fairly simple processes to implement and updated via RPM's? Also, will redhats openssh rpm updates in any way cause problems with rssh once it is installed and configured? Thanks in advance for comments. --- Aaron Axelsen Learning Technology Center UW - Whitewater |
From: Ben B. <ben...@pr...> - 2003-09-13 13:36:25
|
Hi Derek, Just wondering how the move went/is going. Hope things are well. Pretty anxious to get this working, so was just wondering about the possibility to get that tarball of the new version over to me. I understand your probably swamped with stuff concerning the move and you might not even have net access. But just thought a small reminder couldn't hurt... Cheers Ben Birnbaum Quoting Derek Martin <co...@pi...>: > On Mon, Sep 01, 2003 at 11:06:18PM +1000, Ben Birnbaum wrote: > I have run into this problem with certain clients, and I have fixed > this in 2.1.2, which I haven't released yet. I believe it's ready for > release, but the reason I haven't released it yet is because I added > code to allow cvs, rsync, and rdist, which I have not had time to test. > > If you want to try it out, I could e-mail you a tarball. But I won't > be able to do it until at least Friday, because I'm right in the > middle of moving to another country, and I won't have access to e-mail > again until at least then. :) > > -- > Derek D. Martin > http://www.pizzashack.org/ > GPG Key ID: 0x81CFE75D > > |
From: Manolis S. <ms...@cs...> - 2003-09-10 14:24:43
|
Hi, I use rssh on gentoo with metalog as the system logger. I can see some logging from rssh in /var/log/everything/current, but the logs only concern opening and closing a session. Is this the only logging rssh provides? I'd like also to have logs about the files sftp users get/put. Can this be achieved somehow? Thanks, Manolis |
From: Ben B. <ben...@pr...> - 2003-09-01 15:07:02
|
Derek, Cheers for the quick reply. I figured I didn't need per-user config lines and initially I was trying it without, I added that line just to double check that it indeed wasn't needed and it's absense wasn't the reason that things weren't working. [quote Derek] > This is because rssh is expecting the sftp client to pass it the full > path to the sftp-server. What are you using on the client side? If > you're using the OpenSSH sftp client, it SHOULD do that. But I guess > there's no guarantee... [/quote] Yeh - I figured something along these lines was to blame. For the record I am using the openSSH sftp client. It doesn't however seem to be functioning correctly I guess..... [quote Derek] > I have run into this problem with certain clients, and I have fixed > this in 2.1.2, which I haven't released yet ...... > If you want to try it out, I could e-mail you a tarball. But I won't > be able to do it until at least Friday, because I'm right in the > middle of moving to another country, and I won't have access to e-mail > again until at least then. :) [/quote] Yeh - I'd be happy to give it a try if it could fix my problem. No huge rush - just get it to me when you can. Good luck with the move. :) [quote Derek] > FWIW, if you actually ran this command: > > $ ssh remotehost /usr/lib/sftp-server > > it should allow you to connect. I'm not positive it will work beyond > that, but I think it will. Obviously, that's not a permanent > solution, but it should at least let you test things... [/quote] That does allow me to connect but I can't do anything else after then, it just sits there. So it proves that the fact that the full path to the sftp-server isn't getting passed is the problem. Except it doesn't really help me test anything to do with the chroot environment or anything....I'll just use the chroot command for that I guess.... I don't understand why it is the clients job to provide the path to the server binary? Shouldn't this have nothing to do with the client? Forgive my ignorance if I am mistaken - not much of an authority on the inner working of ssh and sftp. Perhaps you could claify this a bit better for me, would be interested to know... Once again, thanks for the quick reply and for the help. Cheers Ben |