Originally posted by: SystemAdmin

Hi,

I`ve been given the task to figure out how to jail a user into his home directory at login. I can`t use a restricted shell as the user also needs access to his home subdirectories. After some searches, I`ve been exploring the chroot way.

I created a test user called restrict and I recreated the proper hierarchy with the appropriate permissions in /home/restrict. As root, I can /usr/sbin/chroot /home/restrict /usr/bin/ksh into it and it works the way I need it to except that when I run the ls -l command, I get the numeric uids and gids instead of the names. I copied the /etc/passwd and /etc/groups into /home/restrict/etc but that didn`t seem to help...

Anyhow, I can live with that for now. My big issue is forcing the restrict user to login into that chrooted environment. I can`t figure out what to put in /etc/passwd as the login command for the user.... I tried running a script with:

#!/usr/bin/ksh
/usr/sbin/chroot /home/restrict /usr/bin/ksh

but that doesn`t work. I get permissions problems. When I changed the permissions on /usr/sbin/chroot, I got operation not permitted on /home/restrict. I thought I finally managed to get around it by setting the sticky bit on /usr/sbin/chroot but later discovered that my restrict user now had root privileges... I`ve found a lot of information (even here) on setting up an jailed ftp user but wasn`t able to mimic that for my purposes. As well, there are many howtos on setting up jailed/chrooted users but none for AIX that I found...

Any and all help would be greatly appreciated... Thanks in advance,

Andre
#AIX-Forum

Originally posted by: esv

You need to add the script's name to the /etc/security/login.cfg shells stanza.

best regards,
enrique.
#AIX-Forum

Originally posted by: SystemAdmin

Thanks Enrique but that wasn`t it, I already did that. Basically, I had 2 issues:

1- I didn`t have the latest version of SSH installed which contains a patch for chroot
2- I used a script to setup my environment and another to remove everything so every time, I would recreate the user. What happen`s the first time the user logs in, it asks for a password change and for some reason, that just killed the ssh session.

Here`s the info I finally found and used:

New version of openssh-4.5 (openssh-4.5p1-r2 ) has been release by IBM.
You can download it from the following link :
http://sourceforge.net/projects/openssh-aix
This release supports chroot.

Setting Up chroot/jailed Environment:
Let us create a directory say /home/chroot so that we can create chroot
environment under this directory. So all the chrooted users get jailed
under this directory i.e. they will not be able to see any files outside
the /home/chroot directory.

You need to create some directories in this /home/chroot directory and
copy important( needed ) binaries like:
mkdir -p /home/chroot/home
cd /home/chroot
mkdir etc
mkdir bin
mkdir lib
mkdir usr
mknod dev/null c 2 2
mknod dev/zero c 2 3
mknod dev/tty c 1 3

Procedure to create chrooted users:

Run the following commands:
useradd -s /bin/ksh -m -d /home/chroot/./home/username/ -c <"> <username>
Assign password to this user

Copy the entry for <username> in the /etc/passwd file to
/home/chroot/etc/passwd file

Also copy the entry for that user in the /etc/groups to
/home/chroot/etc/groups files

P.S : You need to copy all the binaries that you want to run in the new chrooted directory:
eg: say you want to run ls command in the chrooted envirnoment, then do ' ldd on /usr/bin/ls "
copy all the displayed libraries in the corresponding directories of the chroot.
also copy the binary in the corresponding directory along with the proper permissions.

Now you can run the ls command in the chrooted directory.
#AIX-Forum

Originally posted by: SystemAdmin

Hi ALL!

What do whith new account change password promt? How fix it?
When I login in chrooted system under new user(who have flags = ADMCHG in /etc/security/passwd) I recive next error:
==============================================================
~$ ssh usertst@host
usertst@host's password:
files: 3004-610 You are required to change your password.
Please choose a new one.
Last login: Fri Apr 18 16:02:59 NOVST 2008 on /dev/pts/2 from userhost
WARNING: Your password has expired.
You must change your password now and login again!
You are not authorized to change "usertst's" password.
Connection to host closed.
==============================================================

I try copy /usr/bin/who /usr/bin/passwd in chroot tree, but no result
#AIX-Forum