参考 OpenSSH (chroot) の設定

# useradd  umi
# passwd umi
New UNIX password:← パスワードを入力
Retype new UNIX password:← 再入力
# rm /home/umi/.bash*
# usermod -d /home/umi/./ umi

#!/bin/bash

#
# Usage: ./create_chroot_env username
#

# Here specify the apps you want into the enviroment
APPS="/bin/bash /bin/ls /bin/mkdir /bin/mv /bin/pwd /bin/rm \
/usr/bin/id /usr/bin/rsync /bin/ping \
/bin/cp /bin/chmod /bin/cat /usr/local/libexec/sftp-server"

# Sanity check
if [ "$1" = "" ] ; then
    echo "    Usage: ./create_chroot_env username"
  exit
fi

# Obtain username and HomeDir
CHROOT_USERNAME=$1
HOMEDIR=`grep /etc/passwd -e "^$CHROOT_USERNAME" | cut -d':' -f 6`
cd $HOMEDIR

# Create Directories no one will do it for you
mkdir etc
mkdir bin
mkdir dev
mkdir -p usr/bin
mkdir -p usr/local/{bin,libexec}

# Create short version to /usr/bin/groups
# On some system it requires /bin/sh,
# which is generally unnessesary in a chroot cage

echo "#!/bin/bash" > usr/bin/groups
echo "id -Gn" >> usr/bin/groups

# Add some users to ./etc/paswd
grep /etc/passwd -e "^root" -e "^$CHROOT_USERNAME" > etc/passwd
grep /etc/group -e "^root" -e "^$CHROOT_USERNAME" > etc/group

# Copy the apps and the related libs
for prog in $APPS;  do
   cp $prog ./$prog

 # obtain a list of related libraryes
    ldd $prog > /dev/null
    if [ "$?" = 0 ] ; then
     LIBS=`ldd $prog | awk '{ print $3 }'`
       for l in $LIBS; do
          mkdir ./`dirname $l` > /dev/null 2>&1
         cp  $l ./$l
     done
    fi
done

# From some strange reason these 3 libraries are not in the ldd output,
 # but without them some stuff will not work, like usr/bin/groups
cp /lib/libnss_compat.so.2 /lib/libnsl.so.1 /lib/libnss_files.so.2 ./lib/

# My original openssh'settings needs
cp -L /lib/ld-linux.so.2 ./lib/
cp /etc/{ld.so.cache,ld.so.conf,localtime} ./etc/
cp -a /dev/{null,random,zero} ./dev/

# chmod -c 700 create_chroot_env
# ./create_chroot_env umi

$ ldd /bin/bash
        linux-gate.so.1 =>  (0x00653000)
        libtermcap.so.2 => /lib/libtermcap.so.2 (0x07f04000)
        libdl.so.2 => /lib/libdl.so.2 (0x009c9000)
        libc.so.6 => /lib/libc.so.6 (0x00861000)
        /lib/ld-linux.so.2 (0x0083f000)

[umi@mars ~]$ ssh-keygen -t dsa
Generating public/private dsa key pair.
Enter file in which to save the key (/home/umi/.ssh/id_dsa):← Enterキー
Created directory '/home/umi/.ssh'.
Enter passphrase (empty for no passphrase):← パスフレーズを入力
Enter same passphrase again:← 再入力
Your identification has been saved in /home/umi/.ssh/id_dsa.
Your public key has been saved in /home/umi/.ssh/id_dsa.pub.
The key fingerprint is:
32:d5:15:a2:7e:9a:ee:0d:3d:80:3f:38:83:5a:f7:a0 umi@mars.528p.com
[umi@mars ~]$

[umi@venus ~]$ mkdir .ssh
[umi@venus ~]$ cat id_dsa.pub >> .ssh/authorized_keys
[umi@venus ~]$ chmod 700 .ssh
[umi@venus ~]$ chmod 600 .ssh/authorized_keys

[umi@mars ~]$ ssh umi@venus.528p.com
The authenticity of host 'venus.528p.com (192.168.0.1)'
can't be established.
RSA key fingerprint is
bb:b5:74:b8:f4:b2:79:ca:84:7b:96:a4:be:6e:ae:50.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'venus.528p.com,192.168.0.1'
(RSA) to the list of known hosts.
Enter passphrase for key '/home/umi/.ssh/id_dsa':← パスフレーズを入力
-bash-3.1$ ls
bin  dev  etc  lib  usr
-bash-3.1$ cd ..
-bash-3.1$ ls
bin  dev  etc  lib  usr
-bash-3.1$ exit
logout
Connection to venus.528p.com closed.

[umi@mars ~]$ sftp umi@venus.528p.com
Connecting to venus.528p.com...
Enter passphrase for key '/home/umi/.ssh/id_dsa':← パスフレーズを入力
sftp> ls
bin  dev  etc  lib  usr
sftp> cd ..
sftp> ls
bin  dev  etc  lib  usr
sftp> exit
[umi@mars ~]$