On Thu, Mar 23, 2006 at 07:25:27AM -0500, Kevin Alford wrote:
> I am trying to configure pam_chroot on Redhat ES4. My log files are
> really not giving me any information regarding chroot.
> What am I doing wrong? Does anyone have any documentation on how to
> setup chroot for SSH on RedHat?
> I haven't been able to find any good documentation regarding
> pam_chroot. Any help is greatly appreciated.
>
>
> My etc/pam.d/sshd configuration is below:
> #%PAM-1.0
> auth required pam_stack.so service=system-auth
> auth required pam_nologin.so
> account required pam_stack.so service=system-auth
> password required pam_stack.so service=system-auth
> session required /lib/security/pam_chroot.so debug
> session required pam_stack.so service=system-auth
> session required pam_loginuid.so
you should be seeing at least some debug messages in syslog. iirc, the
pam_chroot redhat uses doesn't say much, but there should be something.
maybe check your syslog.conf settings to make sure you're capturing
DEBUG level messages.
also, you *probably* want pam_chroot to be the last session module you
run, unless you have duplicated all the support for the rest of the
modules inside the chroot jail.
> My /etc/security/chroot.conf looks like this
> more chroot.conf
> # /etc/security/chroot.conf
> # format:
> # username_regex chroot_dir
> jdoe /home/jdoe
>
> /home/jdoe looks like this:
>
> -rw------- 1 root root 92 Mar 19 23:13 .bash_history
> -rw-r--r-- 1 root root 41 Mar 16 15:55 .bash_login
> -rw-r--r-- 1 root root 20 Mar 16 13:58 .bash_logout
> -rw-r--r-- 1 root root 131 Mar 16 16:21 .bash_profile
> -rw-r--r-- 1 root root 124 Mar 16 13:51 .bashrc
> drwxr-xr-x 2 root root 4096 Mar 22 11:53 bin
> drwxr-xr-x 2 root root 4096 Mar 22 11:56 home
> drwxr-xr-x 2 root root 4096 Mar 22 11:58 lib
> -rw-r--r-- 1 root root 27 Mar 16 16:16 .profile
> drwx------ 2 jdoe jdoe 4096 Mar 16 13:56 .ssh
> -rw------- 1 jdoe jdoe 426 Mar 22 12:36 .Xauthority
what's in /home/jdoe/{bin,lib}/ ? is this set up as a full chroot?
another thing you can do to debug is to start up a debugging instance of
sshd and strace it:
# strace -fv /usr/sbin/sshd -p 8022 -d -d -d -D
and then from a seperate window, try sshing in on port 8022.
% ssh -p 8022 jdoe@localhost
cheers,
--
Ed Schmollinger - schmolli@xxxxxxxxxxxxxx - http://frozencrow.org/
Attachment:
pgpfY0ZVfeQPL.pgp
Description: PGP signature
_______________________________________________ Pam-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/pam-list
