On Sat, Dec 01, 2007 at 05:18:58PM +0100, Jean-François Leroux wrote:
> Hi, i'm trying to set up a a restricted account with rssh
> inside a debian vserver.
> So far it doesn't work with the chroot option.
what exactly fails there?
> As soon as I stop using it, I can connect via sftp.
> So, I guess somethings wrong with my chroot.
> I tried adding various libraries, as stated over several
> threads in forums, with no avail.
hmm, interesting ... chroot() is a kernel syscall,
so it should not require any extra libraries ...
> One tip I couldn't try was to create a null device
> inside the chroot directory (mknod not working inside
> a vserver, am i right here ?).
yes, that is intentional, you can disable it by
adding the proper capability, but it is considered
insecure if you can create arbitrary devices
(without a device mapping feature)
> So I wanted to ask if somebody had succeded in doing
> so, and possibly how...
chroots inside guests work perfectly fine, if you
need devices inside the chroot (should not be the
case for most services) pre-create them (the secure
ones) by copying them from the guest's /dev dir
(on the host)
> Thanks for your help
HTH,
Herbert
Received on Sun Dec 2 11:49:35 2007