Re: [vserver] chrooted rssh inside a vserver

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Sun 02 Dec 2007 - 11:49:22 GMT
Message-ID: <20071202114922.GA564@MAIL.13thfloor.at>

On Sat, Dec 01, 2007 at 05:18:58PM +0100, Jean-François Leroux wrote:
> Hi, i'm trying to set up a a restricted account with rssh
> inside a debian vserver.

> So far it doesn't work with the chroot option.

what exactly fails there?

> As soon as I stop using it, I can connect via sftp.
> So, I guess somethings wrong with my chroot.

> I tried adding various libraries, as stated over several
> threads in forums, with no avail.

hmm, interesting ... chroot() is a kernel syscall,
so it should not require any extra libraries ...

> One tip I couldn't try was to create a null device
> inside the chroot directory (mknod not working inside
> a vserver, am i right here ?).

yes, that is intentional, you can disable it by
adding the proper capability, but it is considered
insecure if you can create arbitrary devices
(without a device mapping feature)

> So I wanted to ask if somebody had succeded in doing
> so, and possibly how...

chroots inside guests work perfectly fine, if you
need devices inside the chroot (should not be the
case for most services) pre-create them (the secure
ones) by copying them from the guest's /dev dir
(on the host)

> Thanks for your help

HTH,
Herbert
Received on Sun Dec 2 11:49:35 2007

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Sun 02 Dec 2007 - 11:49:39 GMT by hypermail 2.1.8