{"id":1261,"date":"2012-10-03T22:15:22","date_gmt":"2012-10-04T02:15:22","guid":{"rendered":"https:\/\/lowtek.ca\/roo\/?p=1261"},"modified":"2019-12-07T09:54:53","modified_gmt":"2019-12-07T13:54:53","slug":"makejail-limited-ssh-account-on-ubuntu","status":"publish","type":"post","link":"https:\/\/lowtek.ca\/roo\/2012\/makejail-limited-ssh-account-on-ubuntu\/","title":{"rendered":"Makejail – limited SSH account on Ubuntu"},"content":{"rendered":"
\"Jail<\/a>
\n\"Creative<\/a>\u00a0 photo by\u00a0\u00a0hadsie<\/a>\u00a0<\/a><\/div>\n

Previous I had covered how to setup scponly<\/a> as a restricted fileserver environment. While this works well, it is very limited and didn’t allow for rsync<\/a> to run (without heroics beyond what I was willing to do). Using makejail<\/a> seems to be a better solution for my needs, and it turns out to be quite easy to setup on Ubuntu 12.04<\/a>. On the journey here I had also tried out\u00a0rssh<\/a> which I also decided wasn’t a good fit.<\/p>\n

You’ll of course need sshd installed which I’ll assume you have, and makejail which we can install easily:<\/p>\n

$ sudo apt-get install makejail<\/code><\/p>\n

Now we need to modify our openssh<\/a> configuration by editing \/etc\/ssh\/sshd_config<\/code>, there are two changes we need to make.\u00a0Modify the yes setting for UsePrivilegeSeparation:<\/p>\n

# Disable Privilege Separation to allow chroot
\nUsePrivilegeSeparation no
\n<\/code>
\nand at the bottom of the configuration file we’ll add:<\/p>\n

Match User frank
\nChrootDirectory \/home\/frank
\nAllowTCPForwarding no
\nX11Forwarding no
\nPasswordAuthentication no<\/code><\/p>\n

Of course, for each restricted user you need to specify the username and home directory. You may have noticed that for the restricted users I’ve disabled password authentication, this is because changing the password is broken in the ‘jailed’ environment so we just avoid the issue by insisting on the use of keys (yes, you’ll need the restricted user to send you their public key to install in the .ssh\/authorized_keys<\/code> file of the restricted user).<\/p>\n

Next we need to create a simple python script file that we can pass to makejail as a configuration file. I called mine jailconf.py and the contents look like:<\/p>\n

chroot = \"\/home\/frank\"
\ntestCommandsInsideJail = [\"bash\", \"ls\", \"touch\", \"rm\", \"rmdir\", \"less\", \"cat\", \"rsync\" ]<\/code><\/p>\n

Then execute makejail with this configuration file.<\/p>\n

$ sudo makejail jailconf.py<\/code><\/p>\n

For some reason, I needed to run makejail twice initially before it ran without errors – but it is something you can run multiple times with no serious side effects, this is handy if you want to add more commands later.<\/p>\n

That’s it, now if you take a peek at the filesystem structure that’s been created – it’s a chroot environment<\/a>. You’ll probably want to go in and create a \/home\/frank\/stuff<\/code> directory and assign ownership to the user so they can stick files there.<\/p>\n

$ sudo ls -l \/home\/frank
\ntotal 36
\ndrwxr-xr-x 2 root root 4096 Sep 19 22:59 bin
\ndrwxr-xr-x 2 root root 4096 Sep 19 22:55 dev
\ndrwxr-xr-x 3 root root 4096 Sep 19 22:56 etc
\ndrwxrwxrwx 4 frank frank 4096 Sep 19 23:28 stuff
\ndrwxr-xr-x 4 root root 4096 Sep 19 22:55 lib
\ndrwxr-xr-x 2 root root 4096 Sep 19 22:55 root
\ndrwxr-xr-x 2 root root 4096 Sep 19 22:59 sbin
\ndrwxr-xr-x 2 root root 4096 Dec 5 2009 selinux
\ndrwxr-xr-x 5 root root 4096 Sep 19 22:55 usr<\/code><\/p>\n

Now once you sort out the public key login (and remember to make sure the permissions on the .ssh directory and authorized keys are correct), the user frank will be able to log in and see the directory tree \/home\/frank as if it were the root of the filesystem. Only commands listed in the configuration file (jailconf.py) will be available to that user. Of course, if the filesystem is writeable (and executable) then they could always upload copies of the commands they want to run – but hopefully these are people you trust to some level.<\/p>\n

References: I came to this solution initially through this article<\/a>. There was a serverfault post<\/a> that helped with the ssh configuration changes related to disabling password authentication.<\/p>\n

In my case this is one component in allowing a friend to use my system as a remote (encrypted) backup site using rsync. I’ll post more details on that in the future.<\/p>\n","protected":false},"excerpt":{"rendered":"

\u00a0 photo by\u00a0\u00a0hadsie\u00a0 Previous I had covered how to setup scponly as a restricted fileserver environment. While this works well, it is very limited and didn’t allow for rsync to run (without heroics beyond what I was willing to do). Using makejail seems to be a better solution for my needs, and it turns out … Continue reading “Makejail – limited SSH account on Ubuntu”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-1261","post","type-post","status-publish","format-standard","hentry","category-computing"],"_links":{"self":[{"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/posts\/1261","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/comments?post=1261"}],"version-history":[{"count":7,"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/posts\/1261\/revisions"}],"predecessor-version":[{"id":1653,"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/posts\/1261\/revisions\/1653"}],"wp:attachment":[{"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/media?parent=1261"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/categories?post=1261"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/tags?post=1261"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}