OpenSSH (chroot+sshlogin) の設定

[root@jupiter:~]
# useradd -M -s /bin/bash umi
# passwd umi
New UNIX password:← パスワードを入力
Retype new UNIX password:← 再入力
# groupadd -g 103 torikago
# gpasswd -a umi torikago

#!/bin/bash

#
# Usage: ./create_chroot_env5 username
#

# Here specify the apps you want into the enviroment
APPS="/bin/bash /bin/cat /bin/cp /bin/chmod /bin/ls \
/bin/mkdir /bin/mv /bin/touch /bin/pwd /bin/rm /bin/vi \
/usr/bin/id /usr/local/bin/scp /usr/local/bin/sftp \
/usr/local/libexec/sftp-server"

# Sanity check
if [ "$1" = "" ] ; then
    echo " Usage: ./create_chroot_env5 username"
    exit
fi

# Obtain username and HomeDir
CHROOT_USERNAME=$1
HOMEDIR=`grep /etc/passwd -e "^$CHROOT_USERNAME" | cut -d':' -f 6`
mkdir $HOMEDIR
chown root:root $HOMEDIR
cd $HOMEDIR

# Create writeable Directories only for you
mkdir {data,public_html}
chown $1:$1 {data,public_html}
chmod 711 {data,public_html}

# Create Directories no one will do it for you
mkdir {etc,bin,dev}
mkdir -p usr/bin
mkdir -p usr/local/{bin,libexec}
MAKEDEV -d dev -x null random zero

# Create short version to /usr/bin/groups
# On some system it requires /bin/sh,
# which is generally unnessesary in a chroot cage

echo "#!/bin/bash" > usr/bin/groups
echo "id -Gn" >> usr/bin/groups

# Add some users to ./etc/passwd
grep /etc/passwd -e "^root" -e "^$CHROOT_USERNAME" > etc/passwd
grep /etc/group -e "^root" -e "^$CHROOT_USERNAME" > etc/group

# Copy the apps and the related libs
for prog in $APPS; do
    cp $prog ./$prog

    # obtain a list of related libraryes
    ldd $prog > /dev/null
    if [ "$?" = 0 ] ; then
    LIBS=`ldd $prog | awk '{ print $3 }'`
        for l in $LIBS; do
        mkdir -p ./`dirname $l` > /dev/null 2>&1
        cp $l ./$l
       done
    fi
done

# From some strange reason these 3 libraries are not in the ldd output,
# but without them some stuff will not work, like usr/bin/groups
cp /lib/{libnss_compat.so.2,libnsl.so.1,libnss_files.so.2} ./lib/

# My original openssh'settings needs
cp -L /lib/ld-linux.so.2 ./lib/
cp /etc/{ld.so.cache,ld.so.conf,localtime} ./etc/

[root@jupiter:~]
# chmod -c 700 create_chroot_env5
# ./create_chroot_env5 umi

$ ldd /bin/bash
        linux-gate.so.1 =>  (0xb7ff0000)
        libtermcap.so.2 => /lib/libtermcap.so.2 (0x4ac86000)
        libdl.so.2 => /lib/libdl.so.2 (0x4ac7f000)
        libc.so.6 => /lib/i686/nosegneg/libc.so.6 (0x4ab21000)
        /lib/ld-linux.so.2 (0x4ab02000)

Port 22
AddressFamily inet
ListenAddress 0.0.0.0
AllowGroups wheel torikago

SyslogFacility AUTHPRIV
LogLevel VERBOSE
PermitRootLogin without-password
RSAAuthentication no
PubkeyAuthentication yes
IgnoreUserKnownHosts yes
PasswordAuthentication no
ChallengeResponseAuthentication no
X11UseLocalhost no
PrintMotd no
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,arcfour

Subsystem    sftp    /usr/local/libexec/sftp-server

Match Group torikago
    PasswordAuthentication yes
    AllowAgentForwarding no
    AllowTcpForwarding no
    ChrootDirectory /home/%u

[root@jupiter:~]
# service sshd restart

# cd /home/umi
[root@jupiter:/home/umi]
# mkdir .ssh
# cat id_dsa.pub >> .ssh/authorized_keys
# chmod 700 .ssh
# chmod 600 .ssh/authorized_keys
# chown -R umi:umi .ssh

# cd ~
[root@jupiter:~]
# restorecon -Rv /etc
# restorecon -RFv /home/umi

[umi@mars:~]
$ scp test.html umi@jupiter.528p.com:public_html
test.html                      100%  228     0.2KB/s   00:00

[umi@mars:~]
$ sftp umi@jupiter.528p.com
Connecting to jupiter.528p.com...
sftp> pwd
Remote working directory: /
sftp> cd ..
sftp> pwd
Remote working directory: /
sftp> cd /home/sola
Couldn't canonicalise: No such file or directory   
sftp> cd data
sftp> pwd
Remote working directory: /data
sftp> put openssh-5.8p1.tar.gz
Uploading openssh-5.8p1.tar.gz to /data/openssh-5.8p1.tar.gz
openssh-5.8p1.tar.gz           100% 1087KB   1.1MB/s   00:01   
sftp> ls
openssh-5.8p1.tar.gz
sftp> exit
$

・wheelグループのユーザでsftp接続

[sola@mars:~]
$ sftp sola@jupiter.528p.com
Connecting to jupiter.528p.com...
sftp> cd /home/umi/data
sftp> pwd
Remote working directory: /home/umi/data
sftp> ls
remote readdir("/home/umi/data/"): Permission denied
sftp> exit
$