CODEWITHSUNDEEP
linuxchrootjail
Andrei Serdeliuc ॐ
Andrei Serdeliuc ॐ

Reputation: 5878

How to jail linux user

Is there something similar to chroot, but for users?

We are about to grant access to our servers for a client and would like them to see only the directories we allow.

Upvotes: 6

Views: 12907

Answers (6)

user1293603
user1293603

Reputation: 59

No easy way to jail users in their homedirs. BTW, I would NEVER give access to my systems to someone I don't trust a minimum.

Last time I did, I used an "unescapable" menu based on http://bash.cyberciti.biz/guide/A_menu_box The .bashrc launches this script you would not escape :

~/.bashrc :
(LAST LINE)
./menu.sh; exit 0

Yes, I had to write scripts for each and every menu item (get logs, check sys, ...) but nobody to run 'chown -R root:root /' instead of *. Priceless.

[EDIT] : create a dedicated user, don't do this as root !!!

Upvotes: 0

unwellmilles
unwellmilles

Reputation: 45

An effective way to do this is to use lshell

Upvotes: 1

huyz
huyz

Reputation: 2371

The "best answer" from 2009 is outdated. OpenSSH now comes with the ChrootDirectory option. See http://www.debian-administration.org/articles/590 which is for an already-old version of ssh.

Upvotes: 5

Tiberiu Ana
Tiberiu Ana

Reputation: 3663

A Google search on "openssh jail" led me to SSHjail for openSSH. If your client uses ssh/scp to access the said servers, this might be what you are looking for.

Upvotes: 7

Chas. Owens
Chas. Owens

Reputation: 64929

It is important to note that chroot(2) is not meant for security purposes. It is incredibly easy to escape a chroot jail. See this article on abusing chroot for more information.

Upvotes: 4

David Schmitt
David Schmitt

Reputation: 59355

If you really want to go to that extreme, SE Linux (or any other mandatory access control) is a definite improvement of the default unix permissions.

Upvotes: 1

Related Questions