bugJailkit - Bugs: bug #40711, Enhancement - jk_jailuser must...

 
 

bug #40711: Enhancement - jk_jailuser must match user against UID/GID

Submitter:  Declercq Laurent <nuxwin>
Submitted:  Tue 26 Nov 2013 04:47:30 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Need Info
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 04 Nov 2015 09:43:22 PM UTC, comment #2: 

closing, no input received

Olivier Sessink <oli4>
Group administrator
Sat 21 Dec 2013 09:13:12 PM UTC, comment #1: 

a patch is welcome!

I've never used jailkit with any of the ISP control panels, so if you have a tested patch I would appreciate that.

Olivier Sessink <oli4>
Group administrator
Tue 26 Nov 2013 04:47:30 PM UTC, original submission:  

Hello ;

Often, a jailed SSH user is set with UID and GID of an existent user on the system. For instance, it's the case of some ISP control panel (i-MSCP, ispConfig...), which allow to setup a restricted SHELL for the customers:

1. An unix user without any privilege is created, which is used to run PHP/CGI scripts, give an ftp access...
2. An another SSH user with identical UID/GID is created, which is jailed using JailKit

Well, the problem with this pattern is that if the UID/GID of the "parent user" are changed, the properties of the jailed SSH user must be changed too. While this change is done easily using the usermod command, updating the passwd file inside the jail is not so simple and furthermore should stay a concern of the jk_jailuser script anyway.

Indeed, for now, when we run the jk_jailuser tool script several time, a check is made on the presence of the user in the /etc/passwd file (inside the jail) and on the homedir existence.

It could be great to also check the UID/GID and update them if they doesn't match with those from the system passwd file.

BTW: I can provide a patch for such enhancement if you are ok.

Thanks you

Declercq Laurent <nuxwin>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by oli4 (Posted a comment)
  • -email is unavailable- added by nuxwin (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-11-04 oli4 Open/ClosedOpen Closed
    2013-12-21 oli4 StatusNone Need Info

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code