Re: your mail
On Wed, Dec 27, 2000 at 04:47:26PM +1000, Ian wrote:
> opps I'll try that again.
> I would like to know the answer to your problem as we have the same issue,
> ie users can "see" the entire drive structure when connecting via ssh but
> if they connect via ftp their relevent "home" directory becomes the root.
> Obviously we would prefer to limit ssh to the allowed area only
About this whole issue of chrooting the user's environment. I think
there is not too much point. A chroot is to prevent users gaining root,
right? Well if they happen to need a SUID binary then they can gain
root and break out of the jail. If they don't need SUID binaries then
get rid of them... or make sure the ones you have are safe.
Chroot makes a great lot of sense for things like ftp on a webserver
where they only need access to their home directory. But on a
production system they need access to a number of thing, like /usr/bin,
/usr/lib, /usr/include (maybe) etc. By chrooting them you are just
replicating your whole system in their home directory.
You could do more productive things in the time you waste trying to
chroot them, such as making sure permissions are correct on certain
directories, binaries, scripts (which might be run by cron as root or
something) etc. You can also check that there are no programs installed
that you don't need. I am not such an expert on securing systems
internally (well I don't even consider myself a security expert at all
:). But perhaps you should be seeking advise on how to secure your
systems.
--
Jeremy Lunn
Melbourne, Australia
Reply to: