rssh-discuss — General discussion of rssh

[PATCH 3/5] Make sure we create a /dev/null device in the jail.

[Ben W. <bw...@ar...>]

The scp program requires /dev/null.  Ensure we create it inside the
jail using the major/minor device numbers of the real device.

Signed-off-by: Ben Walton <bw...@ar...>
---
 mkchroot.sh |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/mkchroot.sh b/mkchroot.sh
index d2abae5..5b91b51 100755
--- a/mkchroot.sh
+++ b/mkchroot.sh
@@ -161,6 +161,8 @@ echo -e "you may need to copy some of the /lib/libnss_* files into the jail.\n"
 #
 
 mkdir -p "$jail_dir/dev"
+echo "Creating /dev/null inside the jail."
+mknod -m 0666 "${jail_dir}/dev/null" c $(stat --format "%t %T" /dev/null)
 
 echo -e "NOTE: you must MANUALLY edit your syslog rc script to start syslogd"
 echo -e "with appropriate options to log to $jail_dir/dev/log.  In most cases,"
-- 
1.7.4.1

[PATCH 5/5] Ensure we copy ld-linux, etc into the jail

[Ben W. <bw...@ar...>]

The linker/loader shared objects must exist inside the jail for things
to function properly.  These files aren't picked up by the ldd import
loop as the output format of ldd differs for this special library.
Copy it in explicitly.

Signed-off-by: Ben Walton <bw...@ar...>
---
 mkchroot.sh |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/mkchroot.sh b/mkchroot.sh
index e765e2f..ba141b9 100755
--- a/mkchroot.sh
+++ b/mkchroot.sh
@@ -136,6 +136,10 @@ for prog in $scp_path $sftp_server_path $rssh_path $chroot_helper_path; do
 	done
 done
 
+# the loop above doesn't grab ld-linux which is needed by every binary
+echo "Copying the linker loader (ld-linux...)"
+cp -p /lib/ld-* "$jail_dir/lib"
+
 echo "copying name service resolution libraries..."
 tar -cf - /lib/libnss*_files* | tar -C "$jail_dir" -xvf - |sed 's/^/\t/'
 
-- 
1.7.4.1

[PATCH 1/5] When importing libraries determined by ldd, script linux-gate

[Ben W. <bw...@ar...>]

The linux-gate library is a virtual library injected by the kernel.
It doesn't actually exist.  The tr | cut filter was grabbing the
memory address and then creating $jail_dir. (including the .) when
trying to copy this library in.

Signed-off-by: Ben Walton <bw...@ar...>
---
 mkchroot.sh |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/mkchroot.sh b/mkchroot.sh
index 9e17d5d..ee98ed8 100755
--- a/mkchroot.sh
+++ b/mkchroot.sh
@@ -128,7 +128,7 @@ cp "$chroot_helper_path" "$jail_dir$chroot_helper_path" || \
 
 for prog in $scp_path $sftp_server_path $rssh_path $chroot_helper_path; do
 	echo "Copying libraries for $prog."
-	libs=`ldd $prog | tr -s ' ' | cut -d' ' -f3`
+	libs=`ldd $prog | grep -v linux-gate | tr -s ' ' | cut -d' ' -f3`
 	for lib in $libs; do
 		mkdir -p "$jail_dir$(dirname $lib)"
 		echo -e "\t$lib"
-- 
1.7.4.1

(resend) Update/modernize mkchroot.sh

[Ben W. <bw...@ar...>]

Hi All,

[Sorry for the resend.  I mucked up my git send-email stuff
somehow...]

I installed rssh on a RHEL5 host yesterday and setup a chroot jail for
a special purpose account.  Although I got it running, the mkchroot.sh
script needed a bit of help to get it all done.  After figuring out
what the script was not doing for me, I modified it with the patches
that will follow this mail so that it runs without error and sets up a
working environment on RHEL5.  The changes I made _should_ be
compatible with older machines too.

I hope these patches are useful.  They're based on the 2.3.3 tarball
download as anonymous cvs at sourceforge has been disabled.

Thanks
-Ben

[PATCH 5/5] Ensure we copy ld-linux, etc into the jail

[Ben W. <bw...@ar...>]

The linker/loader shared objects must exist inside the jail for things
to function properly.  These files aren't picked up by the ldd import
loop as the output format of ldd differs for this special library.
Copy it in explicitly.

Signed-off-by: Ben Walton <bw...@ar...>
---
 mkchroot.sh |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/mkchroot.sh b/mkchroot.sh
index e765e2f..ba141b9 100755
--- a/mkchroot.sh
+++ b/mkchroot.sh
@@ -136,6 +136,10 @@ for prog in $scp_path $sftp_server_path $rssh_path $chroot_helper_path; do
 	done
 done
 
+# the loop above doesn't grab ld-linux which is needed by every binary
+echo "Copying the linker loader (ld-linux...)"
+cp -p /lib/ld-* "$jail_dir/lib"
+
 echo "copying name service resolution libraries..."
 tar -cf - /lib/libnss*_files* | tar -C "$jail_dir" -xvf - |sed 's/^/\t/'
 
-- 
1.7.4.1

[PATCH 4/5] Use a more general method for copying /etc/ld.* files to the jail

[Ben W. <bw...@ar...>]

Use -pR when copying /etc/ld.* into the jail.  Modern linux boxes may
have /etc/ld.so.conf.d/ with files in that directory.  We likely don't
need them, but having them won't hurt.  This makes the command run
without error when the directory exists.

Signed-off-by: Ben Walton <bw...@ar...>
---
 mkchroot.sh |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/mkchroot.sh b/mkchroot.sh
index 5b91b51..e765e2f 100755
--- a/mkchroot.sh
+++ b/mkchroot.sh
@@ -148,7 +148,7 @@ echo "Setting up /etc in the chroot jail"
 mkdir -p "$jail_dir/etc"
 cp /etc/nsswitch.conf "$jail_dir/etc/"
 cp /etc/passwd "$jail_dir/etc/"
-cp /etc/ld.* "$jail_dir/etc/"
+cp -pR /etc/ld.* "$jail_dir/etc/"
 
 echo -e "Chroot jail configuration completed."
 echo -e "\nNOTE: if you are not using the passwd file for authentication,"
-- 
1.7.4.1

[PATCH 3/5] Make sure we create a /dev/null device in the jail.

[Ben W. <bw...@ar...>]

The scp program requires /dev/null.  Ensure we create it inside the
jail using the major/minor device numbers of the real device.

Signed-off-by: Ben Walton <bw...@ar...>
---
 mkchroot.sh |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/mkchroot.sh b/mkchroot.sh
index d2abae5..5b91b51 100755
--- a/mkchroot.sh
+++ b/mkchroot.sh
@@ -161,6 +161,8 @@ echo -e "you may need to copy some of the /lib/libnss_* files into the jail.\n"
 #
 
 mkdir -p "$jail_dir/dev"
+echo "Creating /dev/null inside the jail."
+mknod -m 0666 "${jail_dir}/dev/null" c $(stat --format "%t %T" /dev/null)
 
 echo -e "NOTE: you must MANUALLY edit your syslog rc script to start syslogd"
 echo -e "with appropriate options to log to $jail_dir/dev/log.  In most cases,"
-- 
1.7.4.1

[PATCH 2/5] Modify the way the libnss_files libraries are imported.

[Ben W. <bw...@ar...>]

libnss1_files* seems to be a legacy thing.  The files don't exist on
modern Linux (RHEL5) boxes.  Make the import of these files generic so
that on older boxes libnss1 will still be imported but no errors will
be spit out on newer ones.

Signed-off-by: Ben Walton <bw...@ar...>
---
 mkchroot.sh |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/mkchroot.sh b/mkchroot.sh
index ee98ed8..d2abae5 100755
--- a/mkchroot.sh
+++ b/mkchroot.sh
@@ -137,7 +137,7 @@ for prog in $scp_path $sftp_server_path $rssh_path $chroot_helper_path; do
 done
 
 echo "copying name service resolution libraries..."
-tar -cf - /lib/libnss_files* /lib/libnss1_files* | tar -C "$jail_dir" -xvf - |sed 's/^/\t/'
+tar -cf - /lib/libnss*_files* | tar -C "$jail_dir" -xvf - |sed 's/^/\t/'
 
 #####################################################################
 #
-- 
1.7.4.1

[PATCH 1/5] When importing libraries determined by ldd, script linux-gate

[Ben W. <bw...@ar...>]

From: Ben Walton <bdw...@ar...>

The linux-gate library is a virtual library injected by the kernel.
It doesn't actually exist.  The tr | cut filter was grabbing the
memory address and then creating $jail_dir. (including the .) when
trying to copy this library in.

Signed-off-by: Ben Walton <bdw...@gm...>
---
 mkchroot.sh |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/mkchroot.sh b/mkchroot.sh
index 9e17d5d..ee98ed8 100755
--- a/mkchroot.sh
+++ b/mkchroot.sh
@@ -128,7 +128,7 @@ cp "$chroot_helper_path" "$jail_dir$chroot_helper_path" || \
 
 for prog in $scp_path $sftp_server_path $rssh_path $chroot_helper_path; do
 	echo "Copying libraries for $prog."
-	libs=`ldd $prog | tr -s ' ' | cut -d' ' -f3`
+	libs=`ldd $prog | grep -v linux-gate | tr -s ' ' | cut -d' ' -f3`
 	for lib in $libs; do
 		mkdir -p "$jail_dir$(dirname $lib)"
 		echo -e "\t$lib"
-- 
1.7.4.1

Update/modernize mkchroot.sh

[Ben W. <bw...@ar...>]

Hi All,

I installed rssh on a RHEL5 host yesterday and setup a chroot jail for
a special purpose account.  Although I got it running, the mkchroot.sh
script needed a bit of help to get it all done.  After figuring out
what the script was not doing for me, I modified it with the patches
that will follow this mail so that it runs without error and sets up a
working environment on RHEL5.  The changes I made _should_ be
compatible with older machines too.

I hope these patches are useful.  They're based on the 2.3.3 tarball
download as anonymous cvs at sourceforge has been disabled.

Thanks
-Ben

Re: strange behavior

[Russ A. <rr...@st...>]

Aurelin <au...@au...> writes:

> I'm not that used to umask, but could it be that for some reason your
> default permission is set to 644?
> Because if you then subtract 006, you'd get 64-2.. Maybe this'd lead  to
> 640 (because.. Have you ever heard of a permission set to a value  below
> zero?)

That isn't how umasks work.  They're a bitmask that's applied with a
bitwise and, not subtraction.

With scp or sftp, the default file permission is whatever the ssh client
declares (usually 0644, but it could be 0666 or 0600 depending on the
client).  Then the umask is applied, which at most can remove permission
bits (not add them).

So if the client uploads a file and the client says the permissions should
be 0600, the file will never have less restrictive permissions than 0600.
The only thing umask can be used to do is make the permissions more
restrictive.

-- 
Russ Allbery (rr...@st...)             <http://www.eyrie.org/~eagle/>

Re: strange behavior

[Russ A. <rr...@st...>]

<Cra...@am...> writes:

> In the rssh.conf file I have the following.

> # Set the default umask
> umask = 006
> # Users configuration
> user=bob:006:00011:/test

> Lately for some reason files are not getting the correct permissions
> anymore? they now get 640 instead of 644.

Well, yes.  You're setting the umask to prevent files from having
permissions of 644.  The 006 umask will allow the last digit of the
permissions to be at most 1.

> I change the unask to 000 and the files get a permission of 664 ?

Sounds like it's working properly....

-- 
Russ Allbery (rr...@st...)             <http://www.eyrie.org/~eagle/>

Re: strange behavior

[Aurelin <au...@au...>]

I'm not that used to umask, but could it be that for some reason your  
default permission is set to 644?
Because if you then subtract 006, you'd get 64-2.. Maybe this'd lead  
to 640 (because.. Have you ever heard of a permission set to a value  
below zero?)

I just read that on Linux the default for files is 666.. So 002  
wouldn't give 644 anyway, would it?

*think*

Quoting Cra...@am...:

> In the rssh.conf file I have the following.
>
> # Set the default umask
> umask = 006
> # Users configuration
> user=bob:006:00011:/test
> Lately for some reason files are not getting the correct permissions  
> anymore? they now get 640 instead of 644. I change the unask to 000  
> and the files get
> a permission of 664 ?
>
>
>
> ________________________________
> Privileged and Confidential. This e-mail, and any attachments there  
> to, is intended only for use by the addressee(s) named herein and  
> may contain privileged or confidential information. If you have  
> received this e-mail in error, please notify me immediately by a  
> return e-mail and delete this e-mail. You are hereby notified that  
> any dissemination, distribution or copying of this e-mail and/or any  
> attachments thereto, is strictly prohibited.
>

strange behavior

[<Cra...@am...>]

In the rssh.conf file I have the following.

# Set the default umask
umask = 006
# Users configuration
user=bob:006:00011:/test
Lately for some reason files are not getting the correct permissions anymore? they now get 640 instead of 644. I change the unask to 000 and the files get
a permission of 664 ?



________________________________
Privileged and Confidential. This e-mail, and any attachments there to, is intended only for use by the addressee(s) named herein and may contain privileged or confidential information. If you have received this e-mail in error, please notify me immediately by a return e-mail and delete this e-mail. You are hereby notified that any dissemination, distribution or copying of this e-mail and/or any attachments thereto, is strictly prohibited.

Re: rssh with sudo

[Aurelin <au...@au...>]

Hi Derek

Thanks for your opinion and advice.
I documented in the ChangeLog and the Manpages that I've made some  
changes, and it's also in the sourcecode itself (documented as HEV  
"These are changes for sudo"). I also wrote it in Authors, that the  
sudo additions aren't written by you.
If you want me to change the name itself, I will. I thought it'd  
suffice to just name it "rssh with sudo" (wouldn't find any better  
name, since rssh fits perfectly).

Of course it's not thought to allow full sudo access to anybody. We  
have only restricted sudo (I bet this is difficult, but security is a  
hard thing to deal with, I guess).
And you're sure right if you say that there are many ways to get  
another shell via some commands (which may be allowed via sudo).
We just needed something more secure than our old script (and to be  
honest, not even that one was abused by our users, I think..). rssh  
did that, even with sudo access.

Have a nice day :)


Quoting Derek Martin <co...@pi...>:

> On Thu, Jun 30, 2011 at 01:21:51PM +0200, Aurelin wrote:
>> You can find the download here:
>> http://aurelin.net/downloads.htm
>>
>> Uhm, I versioned it as rssh-2.3.4-2 (2.3.4 for sudo addition, -1 for
>> the rsync-patch, -2 for some corrections and changes), but I'm not
>> sure whether this is okay, so if not, please tell me.
>> I'm a noob, concerning versioning and such.. ;)
>
> What you've done effectively is forked the code.  That's perfectly OK,
> but you probably should give it a different name to indicate that it is
> no longer the main line code.  Or at least clearly document somewhere
> in the software distribution that you've made changes that are not in
> the original code line.
>
> As for the changes themselves, I'm inclined to think that it's a bad
> idea, generally.  It only makes sense in the context of restricting
> sudo (allowing full sudo completely defeats the purpose of rssh).  In
> the general case, configuring restricted sudo access is quite
> difficult to get right... so many things allow you to get a shell, not
> always in obvious ways.  A bug in sudo or any unexpected shell access
> results in a complete system compromise, *even if you use a chroot
> jail*.  I would personally never ever give sudo access to any user
> whom I did not completely trust to have full root access to my
> machine.  YMMV. :)
>
> --
> Derek D. Martin
> http://www.pizzashack.org/
> GPG Key ID: 0x81CFE75D
>
>

Re: rssh with sudo

[Derek M. <co...@pi...>]

On Thu, Jun 30, 2011 at 01:21:51PM +0200, Aurelin wrote:
> You can find the download here:
> http://aurelin.net/downloads.htm
> 
> Uhm, I versioned it as rssh-2.3.4-2 (2.3.4 for sudo addition, -1 for
> the rsync-patch, -2 for some corrections and changes), but I'm not
> sure whether this is okay, so if not, please tell me.
> I'm a noob, concerning versioning and such.. ;)

What you've done effectively is forked the code.  That's perfectly OK,
but you probably should give it a different name to indicate that it is
no longer the main line code.  Or at least clearly document somewhere
in the software distribution that you've made changes that are not in
the original code line.

As for the changes themselves, I'm inclined to think that it's a bad
idea, generally.  It only makes sense in the context of restricting
sudo (allowing full sudo completely defeats the purpose of rssh).  In
the general case, configuring restricted sudo access is quite
difficult to get right... so many things allow you to get a shell, not
always in obvious ways.  A bug in sudo or any unexpected shell access
results in a complete system compromise, *even if you use a chroot
jail*.  I would personally never ever give sudo access to any user
whom I did not completely trust to have full root access to my
machine.  YMMV. :)

-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

Re: Patch to cope with change in latest rsync protocol

[Derek M. <co...@pi...>]

On Wed, Jun 29, 2011 at 02:17:37PM +0200, OBones wrote:
> First of all, thank you for rssh, it's very convenient when one, like 
> me, wants to restrict a user to rsync only.

You're welcome!

> I have a problem though: When using the latest versions of rsync
> where the protocol is 30 or above, rssh prevents it from working
> because rsync uses -e as an internal option.

Yes, and it's also the same command line option that rsync uses to
specify a different remote shell...  So it's either the version, or
it's something that could potentially affect the security of your
system.  it's atrocious interface design IMO, and I won't support it.  

> There is a patch available here:
[...]
> Are there any plans to include such a fix in later versions?

Not ever, no.  I would much rather remove rsync support entirely.
However some of the distros have included rssh and added the patch.
You might have luck with that.  

> Right now I have to add  --protocol=29 in the argument list for
> rsync but that means I cannot use the latest evolutions of the
> protocol unless I patch an compile the application myself. And I
> would have to remember to apply the patch for every new version

I wouldn't worry about that very much.  It's unlikely that there will
ever be another version of RSSH.  The only updates are for security
bugs, and there hasn't been one found in about a year, and that was
fairly trivial.  The last release before that was in 2006.

-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

rssh with sudo

[Aurelin <au...@au...>]

Hello list

I've made some changes on rssh, so it is now possible to use sudo as a  
command.
What I haven't tested is whether this also works in the  
chroot-environment, since I've never needed it.
Except that, it'd be possible to use it the way you can use scp or  
rsync or whatever. The manpages are updated, and I mostly commented  
the parts which are changed or written new..

You can find the download here:
http://aurelin.net/downloads.htm

Uhm, I versioned it as rssh-2.3.4-2 (2.3.4 for sudo addition, -1 for  
the rsync-patch, -2 for some corrections and changes), but I'm not  
sure whether this is okay, so if not, please tell me.
I'm a noob, concerning versioning and such.. ;)

Then, I'd be happy if someone finds errors or security problems  
concerning the sudo addition, and I'd also appreciate if you'd give  
some feedback.

Greetings
Aurelin.

Patch to cope with change in latest rsync protocol

[OBones <ob...@fr...>]

Hello,

First of all, thank you for rssh, it's very convenient when one, like 
me, wants to restrict a user to rsync only.
I have a problem though:
When using the latest versions of rsync where the protocol is 30 or 
above, rssh prevents it from working because rsync uses -e as an 
internal option.

There is a patch available here:

http://patch-tracker.debian.org/patch/series/view/rssh/2.3.2-13/fixes/rsync-protocol.diff

It applies to 2.3.2 but I checked, the code is the same in 2.3.3 and so 
the patch still applies

Are there any plans to include such a fix in later versions?

Right now I have to add  --protocol=29 in the argument list for rsync 
but that means I cannot use the latest evolutions of the protocol unless 
I patch an compile the application myself. And I would have to remember 
to apply the patch for every new version

Regards
Olivier

Re: how I got chroot to work on recent version of CentOS

[Russ A. <rr...@st...>]

stephen <st...@gm...> writes:

> the mkchroot.sh script fails because of the way ldd reports some paths:

http://patch-tracker.debian.org/patch/series/view/rssh/2.3.3-1/fixes/mkchroot.diff

is the patch that we apply on Debian to fix this and a few other issues.

-- 
Russ Allbery (rr...@st...)             <http://www.eyrie.org/~eagle/>

how I got chroot to work on recent version of CentOS

[stephen <st...@gm...>]

CentOS:

the mkchroot.sh script fails because of the way ldd reports some paths:

[root@solo chroot]# ldd /usr/bin/scp
	linux-gate.so.1 =>  (0x00466000)
	libresolv.so.2 => /lib/libresolv.so.2 (0x006ad000)
	libcrypto.so.6 => /lib/libcrypto.so.6 (0x00a77000)
	libutil.so.1 => /lib/libutil.so.1 (0x008f9000)
	libz.so.1 => /usr/lib/libz.so.1 (0x00ce5000)
	libnsl.so.1 => /lib/libnsl.so.1 (0x00851000)
	libcrypt.so.1 => /lib/libcrypt.so.1 (0x00110000)
	libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0x00142000)
	libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x00ebf000)
	libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x00197000)
	libcom_err.so.2 => /lib/libcom_err.so.2 (0x002a4000)
	libnss3.so => /usr/lib/libnss3.so (0x002a7000)
	libc.so.6 => /lib/libc.so.6 (0x00467000)
	libdl.so.2 => /lib/libdl.so.2 (0x00170000)
	libkrb5support.so.0 => /usr/lib/libkrb5support.so.0 (0x00175000)
	libkeyutils.so.1 => /lib/libkeyutils.so.1 (0x0017e000)
	libnssutil3.so => /usr/lib/libnssutil3.so (0x001be000)
	libplc4.so => /usr/lib/libplc4.so (0x0076f000)
	libplds4.so => /usr/lib/libplds4.so (0x00675000)
	libnspr4.so => /usr/lib/libnspr4.so (0x00bf3000)
	libpthread.so.0 => /lib/libpthread.so.0 (0x0063a000)
	/lib/ld-linux.so.2 (0x00e1c000)
	libselinux.so.1 => /lib/libselinux.so.1 (0x0027e000)
	libsepol.so.1 => /lib/libsepol.so.1 (0x001d7000)

so it fails to copy
	/lib/ld-linux.so.2 (0x00e1c000)

Also, I got an error that /dev/null was inaccessible... that its
permissions were wrong... so this fixed that.

[root@solo chroot]# ls -l /dev/null
crw-rw-rw- 1 root root 1, 3 Jan  2  2010 /dev/null

ah-ha. 1,3...

[root@solo chroot]# mknod dev/null c 1 3
[root@solo chroot]# chmod a+rw dev/null

-stephen

SPARC (+Re: Disable CVS (compilation))

[Aurelin <au...@au...>]

Ok, just figured out.. But seems to be a little buggy, it's telling me  
that I must specify cvs with --with-cvs.
So I do, --with-cvs=no (should work, according to the configure file),  
but doesn't help.

Anyway, it'd compile.

Then it comes to the question: How can I compile for  
SPARC-Architecture? I don't get it..

Greetings and thanks
A.

Quoting Aurelin <au...@au...>:

> Hello list
>
> This may be a stupid question, but just didn't figure it out..
> Can I disable cvs at the time of compiling (just something like   
> --without-cvs)?
> This is due to the fact that we have a system type which is not running cvs..
>
> Greetings
>

Disable CVS (compilation)

[Aurelin <au...@au...>]

Hello list

This may be a stupid question, but just didn't figure it out..
Can I disable cvs at the time of compiling (just something like  
--without-cvs)?
This is due to the fact that we have a system type which is not running cvs..

Greetings

Re: Cannot scp with rssh

[Aurelin <au...@au...>]

You're welcome :)

You could also change the line to

user=user:077:000011 , then sftp and scp would be allowed to the  
specified user while everything set as
allowscp
#allowsftp
...
would give the settings for every rssh-user who is NOT specified.

Best wishes
  Aurelin

Quoting Lutfi <lu...@me...>:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hello,
>
> Thank you very much, I have line my conf file,
>
> user=user:077:000100 and when I comment out it the problem fixed.:)
>
> Thanks,
>
> Lutfi
>
> On 04/13/2011 02:53 PM, Aurelin wrote:
>> Which distro and version do you use?
>>
>> I tried to reconstruct your problem, but for me it works.
>> Could you print out the logfile + the verbose output of scp?
>>
>> Have you made some per user settings?
>> These would look like
>> user=user:022:00011 #Allow scp and sftp to user (umask 022)
>>
>> Quoting Lutfi <lu...@me...>:
>>
>>> Hi,
>>>
>>> I tried
>>>
>>>
>>>
>>> # set the log facility.  "LOG_USER" and "user" are equivalent.
>>> logfacility = LOG_USER
>>>
>>> # Leave these all commented out to make the default action for rssh to
>>> lock
>>> # users out completely...
>>>
>>> allowscp
>>> #allowsftp
>>> #allowcvs
>>> #allowrdist
>>> #allowrsync
>>> #allowsvnserve
>>>
>>> # set the default umask
>>> umask = 022
>>>
>>>
>>> this configuration options but still scp gives the same error and I can
>>> connect through sftp with the user I created.
>>>
>>>
>>> On 04/13/2011 01:41 PM, Lutfi wrote:
>>>> Hi,
>>>>
>>>> When I try scp, from my desktop to server it gives the error, that only
>>>> sftp is allowed.
>>>>
>>>> Regard,
>>>>
>>>> Lutfi
>>>>
>>>> On 04/13/2011 12:24 PM, Aurelin wrote:
>>>>> Hi Lutfi
>>>>>
>>>>> What does it mean, you cannot copy? Do you get an error?
>>>>>
>>>>> To your second question:
>>>>> You can use private/public key authentication to log in without
>>>>> password
>>>>> (since rssh is a shell which you can connect to via ssh, you can also
>>>>> use the ssh authentications such as Private/Public key, Password,
>>>>> PAM...
>>>>> Maybe a smartcard would also work :))
>>>>>
>>>>> Greetings
>>>>>
>>>>> Quoting Lutfi <lu...@me...>:
>>>>>
>>>>> Hello,
>>>>>
>>>>> I am newbie on rssh and i want to send some files to my back server by
>>>>> using rssh. I created a user by using
>>>>> "rss...@li..." command and I uncommented the
>>>>> lines
>>>>> for sftp and scp in /etc/rssh.conf. But I cannot scp a file to my
>>>>> server
>>>>> sftp works. What may be the problem.
>>>>>
>>>>> My second question, can I make password-less connetion by using rssh.
>>>>>
>>>>> Regards,
>>>>>
>>>>> Lutfi
>>>>>>
>>>> ------------------------------------------------------------------------------
>>>>
>>>>>>
>>>> Forrester Wave Report - Recovery time is now measured in hours and
>>>> minutes
>>>> not days. Key insights are discussed in the 2010 Forrester Wave
>>>> Report as
>>>> part of an in-depth evaluation of disaster recovery service providers.
>>>> Forrester found the best-in-class provider in terms of services and
>>>> vision.
>>>> Read this report now!  http://p.sf.net/sfu/ibm-webcastpromo
>>>> _______________________________________________
>>>> rssh-discuss mailing list
>>>> rss...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/rssh-discuss
>>>>>>
>>>>
>>>>> ------------------------------------------------------------------------------
>>>>>
>>>>> Forrester Wave Report - Recovery time is now measured in hours and
>>>>> minutes
>>>>> not days. Key insights are discussed in the 2010 Forrester Wave
>>>>> Report as
>>>>> part of an in-depth evaluation of disaster recovery service providers.
>>>>> Forrester found the best-in-class provider in terms of services and
>>>>> vision.
>>>>> Read this report now!  http://p.sf.net/sfu/ibm-webcastpromo
>>>>
>>>>
>>>>
>>>>> _______________________________________________
>>>>> rssh-discuss mailing list
>>>>> rss...@li...
>>>>> https://lists.sourceforge.net/lists/listinfo/rssh-discuss
>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>>
>>>> Forrester Wave Report - Recovery time is now measured in hours and
>>>> minutes
>>>> not days. Key insights are discussed in the 2010 Forrester Wave
>>>> Report as
>>>> part of an in-depth evaluation of disaster recovery service providers.
>>>> Forrester found the best-in-class provider in terms of services and
>>>> vision.
>>>> Read this report now!  http://p.sf.net/sfu/ibm-webcastpromo
>>>> _______________________________________________
>>>> rssh-discuss mailing list
>>>> rss...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/rssh-discuss
>>>
>>>
>>
>>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iQEcBAEBAgAGBQJNpZYUAAoJEOASPA9veM4zBgAIALBJGPhh5ioDfDapBZ85v6N1
> UQYJgIdI5ZxrXUWTMGhiz5MRan3W/KufS4QiW/Yv58XjtszzMOdYINQDqx14mmvm
> 0nPY/dPrJTsfpPJ5LzmzG8xJs7Zo55NXa/+Ff7zmsqmtvBre6xnDdx/Ci7ii+xtG
> BJp6vT2O1+nH60mMHw8gPArKX+X57D5Ohg4dR+LiefigV1PBmA5r4BG6/TT/Xbfw
> sbv9cLLwWm1ZM7OYfM+BUgtnN5ma+2Z/e7ExzNfizrW0txEotVGgwmN5cyXBryfR
> MBNfHcRIFKA3Hw7BBJDcPLBe34HoDw3nuwh6v09QX2zh4TMWaXH3U+3h7mXxz8w=
> =uCqQ
> -----END PGP SIGNATURE-----
>

Re: Cannot scp with rssh

[Lutfi <lu...@me...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

Thank you very much, I have line my conf file,

user=user:077:000100 and when I comment out it the problem fixed.:)

Thanks,

Lutfi

On 04/13/2011 02:53 PM, Aurelin wrote:
> Which distro and version do you use?
> 
> I tried to reconstruct your problem, but for me it works.
> Could you print out the logfile + the verbose output of scp?
> 
> Have you made some per user settings?
> These would look like
> user=user:022:00011 #Allow scp and sftp to user (umask 022)
> 
> Quoting Lutfi <lu...@me...>:
> 
>> Hi,
>>
>> I tried
>>
>>
>>
>> # set the log facility.  "LOG_USER" and "user" are equivalent.
>> logfacility = LOG_USER
>>
>> # Leave these all commented out to make the default action for rssh to
>> lock
>> # users out completely...
>>
>> allowscp
>> #allowsftp
>> #allowcvs
>> #allowrdist
>> #allowrsync
>> #allowsvnserve
>>
>> # set the default umask
>> umask = 022
>>
>>
>> this configuration options but still scp gives the same error and I can
>> connect through sftp with the user I created.
>>
>>
>> On 04/13/2011 01:41 PM, Lutfi wrote:
>>> Hi,
>>>
>>> When I try scp, from my desktop to server it gives the error, that only
>>> sftp is allowed.
>>>
>>> Regard,
>>>
>>> Lutfi
>>>
>>> On 04/13/2011 12:24 PM, Aurelin wrote:
>>>> Hi Lutfi
>>>>
>>>> What does it mean, you cannot copy? Do you get an error?
>>>>
>>>> To your second question:
>>>> You can use private/public key authentication to log in without
>>>> password
>>>> (since rssh is a shell which you can connect to via ssh, you can also
>>>> use the ssh authentications such as Private/Public key, Password,
>>>> PAM...
>>>> Maybe a smartcard would also work :))
>>>>
>>>> Greetings
>>>>
>>>> Quoting Lutfi <lu...@me...>:
>>>>
>>>> Hello,
>>>>
>>>> I am newbie on rssh and i want to send some files to my back server by
>>>> using rssh. I created a user by using
>>>> "rss...@li..." command and I uncommented the
>>>> lines
>>>> for sftp and scp in /etc/rssh.conf. But I cannot scp a file to my
>>>> server
>>>> sftp works. What may be the problem.
>>>>
>>>> My second question, can I make password-less connetion by using rssh.
>>>>
>>>> Regards,
>>>>
>>>> Lutfi
>>>>>
>>> ------------------------------------------------------------------------------
>>>
>>>>>
>>> Forrester Wave Report - Recovery time is now measured in hours and
>>> minutes
>>> not days. Key insights are discussed in the 2010 Forrester Wave
>>> Report as
>>> part of an in-depth evaluation of disaster recovery service providers.
>>> Forrester found the best-in-class provider in terms of services and
>>> vision.
>>> Read this report now!  http://p.sf.net/sfu/ibm-webcastpromo
>>> _______________________________________________
>>> rssh-discuss mailing list
>>> rss...@li...
>>> https://lists.sourceforge.net/lists/listinfo/rssh-discuss
>>>>>
>>>
>>>> ------------------------------------------------------------------------------
>>>>
>>>> Forrester Wave Report - Recovery time is now measured in hours and
>>>> minutes
>>>> not days. Key insights are discussed in the 2010 Forrester Wave
>>>> Report as
>>>> part of an in-depth evaluation of disaster recovery service providers.
>>>> Forrester found the best-in-class provider in terms of services and
>>>> vision.
>>>> Read this report now!  http://p.sf.net/sfu/ibm-webcastpromo
>>>
>>>
>>>
>>>> _______________________________________________
>>>> rssh-discuss mailing list
>>>> rss...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/rssh-discuss
>>>
>>>
>>> ------------------------------------------------------------------------------
>>>
>>> Forrester Wave Report - Recovery time is now measured in hours and
>>> minutes
>>> not days. Key insights are discussed in the 2010 Forrester Wave
>>> Report as
>>> part of an in-depth evaluation of disaster recovery service providers.
>>> Forrester found the best-in-class provider in terms of services and
>>> vision.
>>> Read this report now!  http://p.sf.net/sfu/ibm-webcastpromo
>>> _______________________________________________
>>> rssh-discuss mailing list
>>> rss...@li...
>>> https://lists.sourceforge.net/lists/listinfo/rssh-discuss
>>
>>
> 
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJNpZYUAAoJEOASPA9veM4zBgAIALBJGPhh5ioDfDapBZ85v6N1
UQYJgIdI5ZxrXUWTMGhiz5MRan3W/KufS4QiW/Yv58XjtszzMOdYINQDqx14mmvm
0nPY/dPrJTsfpPJ5LzmzG8xJs7Zo55NXa/+Ff7zmsqmtvBre6xnDdx/Ci7ii+xtG
BJp6vT2O1+nH60mMHw8gPArKX+X57D5Ohg4dR+LiefigV1PBmA5r4BG6/TT/Xbfw
sbv9cLLwWm1ZM7OYfM+BUgtnN5ma+2Z/e7ExzNfizrW0txEotVGgwmN5cyXBryfR
MBNfHcRIFKA3Hw7BBJDcPLBe34HoDw3nuwh6v09QX2zh4TMWaXH3U+3h7mXxz8w=
=uCqQ
-----END PGP SIGNATURE-----