chroot-ing a User?

Question

Level 1

19 points

chroot-ing a User?

I've been trolling the web for a couple days to find out how to 'chroot' a user to a particular directory on my machine, but haven't found anything that's very helpful. Was hoping someone here might be able to point me in the right direction. The information I have been able to find all seems to be dated and either doesn't work or I'm missing something fundamental when I try to implement it.

I'm working on a project with several other people and it would be helpful if I could allow them to connect to my machine via SSH or SFTP to drop files into a specific directory and to pick up things that other folks in the group have dropped there previously.

I've created a user account for all of us to share and used NetInfo Manager to switch the account's home directory to a separate volume away from my personal data. Since some of the other folks in the group are not necessarily technical when it comes to computers, I'm going to recommend that they use FileZilla to connect and transfer files because it will run on Mac, Linux and Windows platforms. I've tested the mechanics of this and it works just fine, except for one tiny thing...

The problem is that, from FileZilla (or any other SSH or SFTP connection), I can connect to my machine using the group account and walk almost anywhere on the system and look at the files. While the folks I'm working with are generally trustworthy, I don't necessarily want to rely on their honor to stay out of the spreadsheets containing my financial records, my personal e-mail, etc. Even trustworthy people can fall victim to their own curiosity.

I've found a few articles on how to use chroot, OpenSSH, and OpenSSL to jail a user account to a particular directory, but they all seem to be dated. All of them say that Apple's version of OpenSSH will not support chroot. (Is this still true?) I've only located one article that deals with a version of OS X as recent as 10.4.3, and it uses something called 'scponly'. I can't even get it to compile because of some library mis-matches.

My questions:
1. Has anyone on the list set up something similar on OS X 10.4.11? If so, will you share how?
2. Is the problem with OS X 10.4? Do I need to upgrade to 10.5.x before this will work?
3. Is this functionality that is only enabled on OS X Server? (i.e., has it been deliberately disabled?)
4. Is there another way to accomplish this without necessarily relying on chroot?

Thanks in advance for any replies.
Tom

PowerMac Dual G4 Tower, Mac OS X (10.4.11)

Posted on Dec 4, 2008 8:04 PM

Reply

Answer 1

rccharles

Level 6

13,037 points

Dec 4, 2008 8:30 PM in response to alleytm

Have you tried to turn on the Windows file sharing? There is a drop box in the public folder. Linux supports access to Windows file sharing so you should be able to have everyone access the folder. Both Mac OS and Linux use Samba to support Windows file sharing.

filezilla does have public forums. There is usually some way of limiting a user's access.
http://forum.filezilla-project.org/

Robert

Reply

Answer 2

Dec 5, 2008 7:59 AM in response to alleytm

As a predendum (heh), I read your post more closely and it looks like you have tried the instructions mentioned below. As I mentioned, make sure to use the version of scponly specified in the instructions (not the latest version).

If you keep having trouble, post back and I'll look more carefully at an exchange I had with the author of those instructions for more info, which by the way is another piece of advice.

That is, emailing the (overbusy, child-rearing) author of the instructions can be helpful.

=================
Chrooting in Tiger can be accomplished with a little bit of Terminal work by following these instructions. With some modification, the instructions can also be made to work on Leopard.

As a word of advice, do not download the latest version of scponly but use the 4.1 version specified in the instructions.

By way of encouragement, I have successfully created chrooted logins under both Tiger and Leopard (following the instructions), so it definitely can be done.

hth,

Johnnie Wilcox
aka mistersquid

Message was edited by: mistersquid

Reply

Answer 3

alleytm Author

Level 1

19 points

Dec 5, 2008 7:45 PM in response to mistersquid

Do you have the 4.1 version of scponly? The only one I seem to be able to find online to download is version 4.8 (the latest and the one that I've already tried to install).

Thanks.

Reply

Answer 4

Dec 5, 2008 8:41 PM in response to alleytm

Wouldn't you know it? The sourceforge scponly repository only goes as far back as 4.2!

Try with 4.2 and see if you have any luck. I can't find a copy of 4.1 anywhere. If not, try getting in touch with the folks managing the scponly project and see if they won't make it available to you.

I'm crossing fingers that 4.2 will be just as good as 4.1.

JW

Reply

Answer 5

alleytm Author

Level 1

19 points

Dec 6, 2008 7:09 AM in response to mistersquid

I found a copy of 4.1 (don't ask me where - it was getting late!), but I'm still running into the error. While following the instructions, I get to the point where I download OpenSSL-4.0p1 and try to compile it. I un-tar the gz file and run .configure and get the following error:

checking whether OpenSSL's headers match the library... no
configure: error: Your OpenSSL headers do not match your library.
Check config.log for details.

From the config.log file, the first error I see is:

configure:2151: gcc -c -g -O2 conftest.c >&5
conftest.c:2: error: parse error before 'me'
configure:2157: $? = 1
configure: failed program was:
| #ifndef __cplusplus
| choke me
| #endif

The next error shown is:

configure:2647: checking how to run the C preprocessor
configure:2682: gcc -E conftest.c
configure:2688: $? = 0
configure:2720: gcc -E conftest.c
conftest.c:10:28: error: ac_nonexistent.h: No such file or directory
configure:2726: $? = 1
configure: failed program was:
| /* confdefs.h. */
|
| #define PACKAGE_NAME "OpenSSH"
| #define PACKAGE_TARNAME "openssh"
| #define PACKAGE_VERSION "Portable"
| #define PACKAGE_STRING "OpenSSH Portable"
| #define PACKAGE_BUGREPORT ""
| #define WORDS_BIGENDIAN 1
| /* end confdefs.h. */
| #include <ac_nonexistent.h>

There are many more errors like this, but I'm not sure if they're significant. I went to the end of the log file and all it has there is the statement:

configure: exit 1

Again, I'm not sure if this is useful information. If I try to run the make command, all I get is:

make: * No targets specified and no makefile found. Stop.

Suggestions?

Reply

Answer 6

Dec 6, 2008 9:10 AM in response to alleytm

If the compiler complains your OpenSSL headers don't match your library, you'll have to address that problem in a separate step. Short of starting a new thread, here's some info that you might find helpful.

First, Jim Epler also had an OpenSSL library-header mismatch problem while compiling chroot on 10.3.9. Epler solved his problem by consulting and modifying instructions found on Stepwise. Epler's write-up is worth reading as it may give you insight into fixing the OpenSSL issue, a common one for those who apply Apple's Software Updates.

I found Epler's post in a MacOSXHints about how to " Create a chrooted SSH/SFTP server on OS X", the comments of which you might find helpful. FWIW, I have had and solved such mismatch errors myself.

Again, good luck and kudos to you for persevering. You're bound to turn the corner soon.

JW

Reply