It took me hours to make rssh chroot jail work. There are some steps missing in the document of rssh. Here is how I made it work. I want to set up an account called
"deployer" on host
"chroot_host" to allow some of users remotely copy files under a directory under
/app/platform using passwordless scp. I don't want any user log on the host using
"deployer".
- Install rssh
sudo yum install rssh
rssh.x86_64 2.3.3-2.el6.rf @rpmforge-el6-x86_64
- Edit /etc/rssh.conf
# /etc/rssh.conf
logfacility = LOG_USER
allowscp
#allowsftp
#allowcvs
#allowrdist
#allowrsync
umask = 022
chrootpath = /app/platform/chroot
user=deployer:011:00001:/app/platform/chroot
- Create the user deployer
sudo /bin/groupadd builder
sudo /sbin/useradd -g builder -s /usr/bin/rssh -d /app/platform deployer
- Create .ssh folder for deployer and add public keys to /app/platform/.ssh/authorized_keys
sudo mkdir /app/platform/.ssh
sudo cp id_rsa.pub /app/platform/.ssh/authorized_keys
- Create chroot jail
sudo /usr/share/doc/rssh-2.3.3/mkchroot.sh /app/platform/chroot/
NOTE: Must have "/", otherwise the script will create a folder "/app/platform/chroot."
- Create /dev/null
sudo mknod -m 666 dev/null c 1 3
- Create bin and copy /bin/sh
sudo mkdir /app/platform/chroot/bin
sudo cp /bin/sh /app/platform/chroot/bin
- Copy all files in /lib64 to /app/platform/chroot/lib64
sudo cp /lib64/* /app/platform/chroot/lib64
NOTE: Some of lib files must not be used, but I don't know which files should be kept.
- Create home directory in chroot jail
sudo mkdir /app/platform/chroot/home/deployer
sudo chown deployer:builder /app/platform/chroot/home/deployer
- Edit jailed {{etc/password}} to change the home directory of deployer
deployer:x:501:34075::/home/deployer:/usr/bin/rssh
- Then you can successfully scp a file to the repository
scp a_file.xml deployer@chroot_host:/repository
NOTE: Because we use chroot, the folder is /repository.
Here are the problems I encountered during the setup. Unfortunately, I don't know which step fix the problem.
- "lost connection" Anything is wrong you will get this error.
- "Couldn't open /dev/null: No such file or directory" After copying /bin/sh, got this error. mknod resolved this issue.
- "unknown user 501" After copying all files in /lib64/, it is gone
- "Could not chdir to home directory : No such file or directory" chroot/home/deployer is not created
No comments:
Post a Comment