bugJailkit - Bugs: bug #60178, sftp account is not limited at all...

 
 

bug #60178: sftp account is not limited at all on CentOS 8

Submitter:  Ming Wu <mingwu>
Submitted:  Fri 05 Mar 2021 04:08:19 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Mon 08 Mar 2021 01:47:35 AM UTC, comment #9: 

Indeed, it is much better! Thank you for devoting your time to the free software world!

One minor mistake to correct in my last post is:
# cat /srv/sftpjail/etc/jailkit/jk_lsh.ini
[mike]
paths= /usr/bin, /usr/libexec/openssh/
executables= /usr/bin/scp, /usr/libexec/openssh/sftp-server

 Ming Wu <mingwu>
Sun 07 Mar 2021 06:32:21 PM UTC, comment #8: 

I've updated the howto, and added a section on troubleshooting. Is it better? https://olivier.sessink.nl/jailkit/howtos_sftp_scp_only.html


Olivier Sessink <oli4>
Group administrator
Sun 07 Mar 2021 03:07:31 PM UTC, comment #7: 

Thanks Olivier! Problem solved. I list below all the steps that may save others a couple of minitues if they come to this page in the future. After the steps, user mike can sftp or scp, and only sftp or scp.

Note that all lines begin with "# " are commands typed in CentOS 8 serer as root.

# u=mike
# adduser $u && echo "$u:$u" | chpasswd

# mkdir /srv/sftpjail
# chown root:root /srv/sftpjail
# chmod 0755 /srv/sftpjail
# jk_init -v -j /srv/sftpjail jk_lsh sftp scp
# jk_jailuser -m -j /srv/sftpjail mike

# cat /etc/passwd | grep mike
mike:x:1006:1008::/srv/sftpjail/./home/mike:/usr/sbin/jk_chrootsh

# cat /srv/sftpjail/etc/passwd | grep mike
mike:x:1006:1008::/home/mike:/usr/sbin/jk_lsh

# cat /srv/sftpjail/etc/jailkit/jk_lsh.ini
[mike]
paths= /usr/libexec/openssh/
executables= /usr/libexec/openssh/sftp-server

# cat /etc/ssh/sshd_config | tail -7
Subsystem       sftp    /usr/libexec/openssh/sftp-server
#Subsystem sftp internal-sftp
Match Group sftpgrp
        X11Forwarding no
        AllowTcpForwarding no
        ChrootDirectory %h
        ForceCommand internal-sftp

 Ming Wu <mingwu>
Sun 07 Mar 2021 01:15:44 PM UTC, comment #6: 

from your logs I guess that you don't have logging inside the jail, is that correct?

I guess it is a simple misconfiguration of jk_lsh which is usually very easy to fix if you see the logging messages.

check the section on jk_socketd described in
https://olivier.sessink.nl/jailkit/howtos_sftp_scp_only.html


Olivier Sessink <oli4>
Group administrator
Sun 07 Mar 2021 09:44:40 AM UTC, comment #5: 

Detailed log for two consecutive sftp logins

# sftp #1 on Ubuntu 20.04.2
$ sftp mike@10.168.139.33
mike@10.168.139.33's password:
Connection closed

# ouput #1 on CentOS 8
# journalctl -f
Mar 07 09:37:06 tpc8 sshd[1454]: Accepted password for mike from 10.168.128.164 port 49937 ssh2
Mar 07 09:37:07 tpc8 systemd-logind[736]: New session 9 of user mike.
Mar 07 09:37:07 tpc8 systemd[1]: Started Session 9 of user mike.
Mar 07 09:37:07 tpc8 sshd[1454]: pam_systemd(sshd:session): Failed to create session: Start job for unit user-1006.slice failed with 'canceled'
Mar 07 09:37:07 tpc8 sshd[1454]: pam_unix(sshd:session): session opened for user mike by (uid=0)
Mar 07 09:37:07 tpc8 jk_chrootsh[1459]: now entering jail /srv/sftpjail for user mike (1006) with arguments -c /usr/libexec/openssh/sftp-server
Mar 07 09:37:07 tpc8 sshd[1458]: Received disconnect from 10.168.128.164 port 49937:11: disconnected by user
Mar 07 09:37:07 tpc8 sshd[1458]: Disconnected from user mike 10.168.128.164 port 49937
Mar 07 09:37:07 tpc8 sshd[1454]: pam_unix(sshd:session): session closed for user mike
Mar 07 09:37:07 tpc8 systemd-logind[736]: Session 9 logged out. Waiting for processes to exit.
Mar 07 09:37:07 tpc8 systemd-logind[736]: Removed session 9.

-------------------------------------------------------------
# sftp #2 on Ubuntu 20.04.2 (within 1 minute)
$ sftp mike@10.168.139.33
mike@10.168.139.33's password:
Connection closed

# ouput #2 on CentOS 8
# journalctl -f
Mar 07 09:37:58 tpc8 sshd[1461]: Accepted password for mike from 10.168.128.164 port 49940 ssh2
Mar 07 09:37:58 tpc8 systemd-logind[736]: New session 10 of user mike.
Mar 07 09:37:58 tpc8 systemd[1]: Started Session 10 of user mike.
Mar 07 09:37:58 tpc8 systemd[1]: user@1006.service: State 'stop-sigterm' timed out. Killing.
Mar 07 09:37:58 tpc8 systemd[1]: user@1006.service: Killing process 1445 (systemd) with signal SIGKILL.
Mar 07 09:37:58 tpc8 systemd[1]: user@1006.service: Failed with result 'timeout'.
Mar 07 09:37:58 tpc8 systemd[1]: Starting User Manager for UID 1006...
Mar 07 09:37:58 tpc8 systemd[1466]: pam_unix(systemd-user:session): session opened for user mike by (uid=0)
Mar 07 09:37:59 tpc8 systemd[1466]: dbus.socket: Cannot add dependency job, ignoring: Access denied
Mar 07 09:37:59 tpc8 systemd[1466]: grub-boot-success.timer: Refusing to start, unit to trigger not loaded.
Mar 07 09:37:59 tpc8 systemd[1466]: Failed to start Mark boot as successful after the user session has run 2 minutes.
Mar 07 09:37:59 tpc8 systemd[1466]: Reached target Paths.
Mar 07 09:37:59 tpc8 systemd[1466]: Reached target Timers.
Mar 07 09:37:59 tpc8 systemd[1466]: Reached target Sockets.
Mar 07 09:37:59 tpc8 systemd[1466]: Reached target Basic System.
Mar 07 09:37:59 tpc8 systemd[1466]: Reached target Default.
Mar 07 09:37:59 tpc8 systemd[1466]: Startup finished in 133ms.
Mar 07 09:37:59 tpc8 systemd[1]: Started User Manager for UID 1006.
Mar 07 09:37:59 tpc8 sshd[1461]: pam_unix(sshd:session): session opened for user mike by (uid=0)
Mar 07 09:37:59 tpc8 jk_chrootsh[1475]: now entering jail /srv/sftpjail for user mike (1006) with arguments -c /usr/libexec/openssh/sftp-server
Mar 07 09:37:59 tpc8 sshd[1474]: Received disconnect from 10.168.128.164 port 49940:11: disconnected by user
Mar 07 09:37:59 tpc8 sshd[1474]: Disconnected from user mike 10.168.128.164 port 49940
Mar 07 09:37:59 tpc8 sshd[1461]: pam_unix(sshd:session): session closed for user mike
Mar 07 09:37:59 tpc8 systemd-logind[736]: Session 10 logged out. Waiting for processes to exit.
Mar 07 09:37:59 tpc8 systemd-logind[736]: Removed session 10.
Mar 07 09:37:59 tpc8 systemd[1]: user-runtime-dir@1006.service: Unit not needed anymore. Stopping.
Mar 07 09:37:59 tpc8 systemd[1]: Stopping User Manager for UID 1006...
Mar 07 09:37:59 tpc8 systemd[1466]: Failed to enqueue exit.target job: Access denied

 Ming Wu <mingwu>
Sun 07 Mar 2021 03:37:02 AM UTC, comment #4: 

By following your comment on "sftp internally", I nailed down the problem:

It is this line
Subsystem sftp internal-sftp
in /etc/ssh/sshd_config that breaks the jail.

There is still an issue: user mike got "Connection closed" for sftp.

Thanks alot for the help on sovling this jail break problem!

-----------------------------------------
# Experiment #1
1. content of /etc/ssh/sshd_config on CentOS 8
[root@tpc8 ~]# cat /etc/ssh/sshd_config | tail -7
#Subsystem      sftp    /usr/libexec/openssh/sftp-server
Subsystem sftp internal-sftp
Match Group sftpgrp
        X11Forwarding no
        AllowTcpForwarding no
        ChrootDirectory %h
        ForceCommand internal-sftp
# Please note that we are using internal-sftp here.

2a. ssh on Ubuntu 20.04.2
$ ssh mike@10.168.139.33
mike@10.168.139.33's password:
Last login: Sun Mar  7 03:06:08 2021 from 10.168.128.164
Connection to 10.168.139.33 closed.

2b. output of journalctl -f | grep jk_ on CentOS 8
# journalctl -f |grep jk_
Mar 07 03:10:53 tpc8 jk_chrootsh[1432]: now entering jail /srv/sftpjail for user mike (1006) with arguments

3a. sftp on Ubuntu 20.04.2
$ sftp mike@10.168.139.33
mike@10.168.139.33's password:
Connected to 10.168.139.33.
sftp> pwd
Remote working directory: /srv/sftpjail/home/mike
sftp> cd /var/www/html
sftp> get index.php a3.txt
Fetching /var/www/html/index.php to a3.txt
/var/www/html/index.php                             100% 1228   129.0KB/s   00:00
sftp> bye
# mike succesfully downloaded a file: jail broken

3b. output of journalctl -f | grep jk_ on CentOS 8
nothing
# this indicates that user mike is not jailed for sftp at all.

----------
# Experiment #2
1. content of /etc/ssh/sshd_config on CentOS 8
[root@tpc8 ~]# cat /etc/ssh/sshd_config | tail -7
Subsystem      sftp    /usr/libexec/openssh/sftp-server
#Subsystem sftp internal-sftp
Match Group sftpgrp
        X11Forwarding no
        AllowTcpForwarding no
        ChrootDirectory %h
        ForceCommand internal-sftp
# Please note that we are not using internal-sftp here

2a. ssh on Ubuntu 20.04.2
usr00@ubu00:~$ ssh mike@10.168.139.33
mike@10.168.139.33's password:
Last login: Sun Mar  7 03:10:53 2021 from 10.168.128.164
Connection to 10.168.139.33 closed.

2b. output of journalctl -f | grep jk_ on CentOS 8
# journalctl -f |grep jk_
Mar 07 03:19:13 tpc8 jk_chrootsh[1490]: now entering jail /srv/sftpjail for user mike (1006) with arguments

3a. sftp on Ubuntu 20.04.2
usr00@ubu00:~$ sftp mike@10.168.139.33
mike@10.168.139.33's password:
Connection closed
# mike cannot sftp at all

3b. output of journalctl -f | grep jk_ on CentOS 8
Mar 07 03:20:25 tpc8 jk_chrootsh[1737]: now entering jail /srv/sftpjail for user mike (1006) with arguments -c /usr/libexec/openssh/sftp-server
# this indicates that user mike is jailed for sftp.

 Ming Wu <mingwu>
Sat 06 Mar 2021 08:12:50 AM UTC, comment #3: 

thanks for the extensive info.

it seems that your system does not use /var/log/auth.log to do authorisation logging, but your system does have journalctl.

journalctl |grep jk_chrootsh

will tell you if jk_chrootsh is actually started.

what could be useful is to follow the logs while you log in with either ssh or sftp and look at the differences:

journalctl -f |grep jk_

There is a possibility that your ssh daemon is configured not to start a shell for sftp, but to handle sftp internally. If it is, it will bypass jk_chrootsh. I'm not sure what the confuguration option is, but look at /etc/ssh/sshd_config for specific sftp options.

 Olivier Sessink <oli4>
Group administrator
Sat 06 Mar 2021 03:03:59 AM UTC, comment #2: 

Dear Olivier:

Thanks for your swift reply! Below are all the steps that I perfomed to make the problem reappear.

are you sure jk_chrootsh is actually started?
# ps -ef | grep jk_chrootsh
root        1325    1260  0 02:59 pts/0    00:00:00 grep --color=auto jk_chrootsh
do you get any logging from jk_chrootsh if you ssh into the account?
ssh mike@192.168.1.115 # from ubuntu
mike@192.168.1.115's password:
Connection to 192.168.1.115 closed.
do you get the same logging if you sftp to that account?
Where is the log file?
# find / -iname "*auth.log*" # returns nothing

Ming Wu

--------------------
References:
1. https://olivier.sessink.nl/jailkit/howtos_sftp_scp_only.html
2. https://olivier.sessink.nl/jailkit/jailkit.8.html

# Add user mike
u=mike
adduser $u && echo "$u:$u" | chpasswd

# Initialise the jail
mkdir /srv/sftpjail
chown root:root /srv/sftpjail
chmod 0755 /srv/sftpjail
jk_init -v -j /srv/sftpjail jk_lsh sftp scp
jk_jailuser -m -j /srv/sftpjail mike
# see output of all commmands above at the end

# View info for mike
cat /etc/passwd | grep mike
mike:x:1006:1008::/srv/sftpjail/./home/mike:/usr/sbin/jk_chrootsh

cat /srv/sftpjail/etc/passwd | grep mike
mike:x:1006:1008::/home/mike:/usr/sbin/jk_lsh

cat /srv/sftpjail/etc/jailkit/jk_lsh.ini
[mike]
paths= /usr/lib/
executables= /usr/lib/sftp-server

# reboot CentOS 8 server
# jk_socketd stuff is not performed

# sftp on Ubuntu 20.04.2
sftp mike@192.168.1.115
mike@192.168.1.115's password:
Connected to 192.168.1.115.
sftp> pwd
Remote working directory: /srv/sftpjail/home/mike
sftp> cd /var/www/html
sftp> get index.php a.txt
Fetching /var/www/html/index.php to a.txt
/var/www/html/index.php                             100% 1228   133.9KB/s   00:00
sftp> bye
# mike successfully downloaded a file from /var/www/html

# Some log info: auth.log is not present in CentOS 8
journalctl --since=-1h > jaillog.txt
cat jaillog.txt # output at the end


----------
# u=mike
# adduser $u && echo "$u:$u" | chpasswd
# mkdir /srv/sftpjail
# chown root:root /srv/sftpjail
# chmod 0755 /srv/sftpjail
# jk_init -v -j /srv/sftpjail jk_lsh sftp scp
Source file(s) /lib/libnsl.so.1 do not exist
Source file(s) /lib64/libnsl.so.1 do not exist
Source file(s) /lib/libnss*.so.2 do not exist
Creating symlink /srv/sftpjail/lib64 to usr/lib64
Create directory /srv/sftpjail/usr
Create directory /srv/sftpjail/usr/lib64
Creating symlink /srv/sftpjail/usr/lib64/libnss_compat.so.2 to libnss_compat-2.28.so
Copying /lib64/libnss_compat-2.28.so to /srv/sftpjail/usr/lib64/libnss_compat-2.28.so
Creating symlink /srv/sftpjail/usr/lib64/libc.so.6 to libc-2.28.so
Copying /lib64/libc-2.28.so to /srv/sftpjail/usr/lib64/libc-2.28.so
Creating symlink /srv/sftpjail/usr/lib64/ld-linux-x86-64.so.2 to ld-2.28.so
Copying /lib64/ld-2.28.so to /srv/sftpjail/usr/lib64/ld-2.28.so
Copying /lib64/libnss_sss.so.2 to /srv/sftpjail/usr/lib64/libnss_sss.so.2
Creating symlink /srv/sftpjail/usr/lib64/libnss_dns.so.2 to libnss_dns-2.28.so
Copying /lib64/libnss_dns-2.28.so to /srv/sftpjail/usr/lib64/libnss_dns-2.28.so
Creating symlink /srv/sftpjail/usr/lib64/libresolv.so.2 to libresolv-2.28.so
Copying /lib64/libresolv-2.28.so to /srv/sftpjail/usr/lib64/libresolv-2.28.so
Creating symlink /srv/sftpjail/usr/lib64/libnss_files.so.2 to libnss_files-2.28.so
Copying /lib64/libnss_files-2.28.so to /srv/sftpjail/usr/lib64/libnss_files-2.28.so
Copying /lib64/libnss_systemd.so.2 to /srv/sftpjail/usr/lib64/libnss_systemd.so.2
Creating symlink /srv/sftpjail/usr/lib64/librt.so.1 to librt-2.28.so
Copying /lib64/librt-2.28.so to /srv/sftpjail/usr/lib64/librt-2.28.so
Creating symlink /srv/sftpjail/usr/lib64/libcap.so.2 to libcap.so.2.26
Copying /lib64/libcap.so.2.26 to /srv/sftpjail/usr/lib64/libcap.so.2.26
Creating symlink /srv/sftpjail/usr/lib64/libmount.so.1 to libmount.so.1.1.0
Copying /lib64/libmount.so.1.1.0 to /srv/sftpjail/usr/lib64/libmount.so.1.1.0
Creating symlink /srv/sftpjail/usr/lib64/libgcc_s.so.1 to libgcc_s-8-20191121.so.1
Copying /lib64/libgcc_s-8-20191121.so.1 to /srv/sftpjail/usr/lib64/libgcc_s-8-20191121.so.1
Creating symlink /srv/sftpjail/usr/lib64/libpthread.so.0 to libpthread-2.28.so
Copying /lib64/libpthread-2.28.so to /srv/sftpjail/usr/lib64/libpthread-2.28.so
Creating symlink /srv/sftpjail/usr/lib64/libblkid.so.1 to libblkid.so.1.1.0
Copying /lib64/libblkid.so.1.1.0 to /srv/sftpjail/usr/lib64/libblkid.so.1.1.0
Creating symlink /srv/sftpjail/usr/lib64/libuuid.so.1 to libuuid.so.1.3.0
Copying /lib64/libuuid.so.1.3.0 to /srv/sftpjail/usr/lib64/libuuid.so.1.3.0
Copying /lib64/libselinux.so.1 to /srv/sftpjail/usr/lib64/libselinux.so.1
Creating symlink /srv/sftpjail/usr/lib64/libpcre2-8.so.0 to libpcre2-8.so.0.7.1
Copying /lib64/libpcre2-8.so.0.7.1 to /srv/sftpjail/usr/lib64/libpcre2-8.so.0.7.1
Creating symlink /srv/sftpjail/usr/lib64/libdl.so.2 to libdl-2.28.so
Copying /lib64/libdl-2.28.so to /srv/sftpjail/usr/lib64/libdl-2.28.so
Copying /lib64/libnss_resolve.so.2 to /srv/sftpjail/usr/lib64/libnss_resolve.so.2
Copying /lib64/libnss_myhostname.so.2 to /srv/sftpjail/usr/lib64/libnss_myhostname.so.2
Source file(s) /lib/i386-linux-gnu/libnsl.so.1 do not exist
Source file(s) /lib/i386-linux-gnu/libnss*.so.2 do not exist
Source file(s) /lib/x86_64-linux-gnu/libnsl.so.1 do not exist
Source file(s) /lib/x86_64-linux-gnu/libnss*.so.2 do not exist
Source file(s) /lib/arm-linux-gnueabihf/libnss*.so.2 do not exist
Source file(s) /lib/arm-linux-gnueabihf/libnsl*.so.1 do not exist
Create directory /srv/sftpjail/etc
Copying /etc/nsswitch.conf to /srv/sftpjail/etc/nsswitch.conf
Copying /etc/ld.so.conf to /srv/sftpjail/etc/ld.so.conf
Creating symlink /srv/sftpjail/etc/localtime to ../usr/share/zoneinfo/Asia/Shanghai
Create directory /srv/sftpjail/usr/share
Create directory /srv/sftpjail/usr/share/zoneinfo
Create directory /srv/sftpjail/usr/share/zoneinfo/Asia
Copying /usr/share/zoneinfo/Asia/Shanghai to /srv/sftpjail/usr/share/zoneinfo/Asia/Shanghai
Create directory /srv/sftpjail/usr/sbin
Copying /usr/sbin/jk_lsh to /srv/sftpjail/usr/sbin/jk_lsh
Create directory /srv/sftpjail/etc/jailkit
Copying /etc/jailkit/jk_lsh.ini to /srv/sftpjail/etc/jailkit/jk_lsh.ini
writing user root to /srv/sftpjail/etc/passwd
writing group root to /srv/sftpjail/etc/group
Source file(s) /lib/libnss_dns.so.2 do not exist
Source file(s) /lib/libnss_mdns*.so.2 do not exist
Copying /etc/resolv.conf to /srv/sftpjail/etc/resolv.conf
Copying /etc/host.conf to /srv/sftpjail/etc/host.conf
Copying /etc/hosts to /srv/sftpjail/etc/hosts
Copying /etc/protocols to /srv/sftpjail/etc/protocols
Copying /etc/services to /srv/sftpjail/etc/services
Source file(s) /usr/lib/sftp-server do not exist
Create directory /srv/sftpjail/usr/libexec
Create directory /srv/sftpjail/usr/libexec/openssh
Copying /usr/libexec/openssh/sftp-server to /srv/sftpjail/usr/libexec/openssh/sftp-server
Creating symlink /srv/sftpjail/usr/lib64/libcrypto.so.1.1 to libcrypto.so.1.1.1c
Copying /lib64/libcrypto.so.1.1.1c to /srv/sftpjail/usr/lib64/libcrypto.so.1.1.1c
Creating symlink /srv/sftpjail/usr/lib64/libutil.so.1 to libutil-2.28.so
Copying /lib64/libutil-2.28.so to /srv/sftpjail/usr/lib64/libutil-2.28.so
Creating symlink /srv/sftpjail/usr/lib64/libz.so.1 to libz.so.1.2.11
Copying /lib64/libz.so.1.2.11 to /srv/sftpjail/usr/lib64/libz.so.1.2.11
Creating symlink /srv/sftpjail/usr/lib64/libcrypt.so.1 to libcrypt.so.1.1.0
Copying /lib64/libcrypt.so.1.1.0 to /srv/sftpjail/usr/lib64/libcrypt.so.1.1.0
Source file(s) /usr/lib/misc/sftp-server do not exist
Source file(s) /usr/libexec/sftp-server do not exist
Source file(s) /usr/lib/openssh/sftp-server do not exist
Creating device /srv/sftpjail/dev/urandom
Creating device /srv/sftpjail/dev/null
Create directory /srv/sftpjail/usr/bin
Copying /usr/bin/scp to /srv/sftpjail/usr/bin/scp
# jk_jailuser -m -j /srv/sftpjail mike

----------
cat jaillog.txt
Mar 06 02:38:54 tpc8 unix_chkpwd[1231]: account mike has password changed in future
Mar 06 02:38:54 tpc8 sshd[1228]: Accepted password for mike from 192.168.1.112 port 56056 ssh2
Mar 06 02:38:54 tpc8 systemd[1]: Created slice User Slice of UID 1006.
Mar 06 02:38:54 tpc8 systemd[1]: Created slice system-user\x2druntime\x2ddir.slice.
Mar 06 02:38:54 tpc8 systemd[1]: Started /run/user/1006 mount wrapper.
Mar 06 02:38:54 tpc8 systemd[1]: Starting User Manager for UID 1006...
Mar 06 02:38:54 tpc8 systemd-logind[728]: New session 1 of user mike.
Mar 06 02:38:54 tpc8 systemd[1]: Started Session 1 of user mike.
Mar 06 02:38:54 tpc8 unix_chkpwd[1235]: account mike has password changed in future
Mar 06 02:38:54 tpc8 systemd[1233]: pam_unix(systemd-user:session): session opened for user mike by (uid=0)
Mar 06 02:38:54 tpc8 systemd[1233]: dbus.socket: Cannot add dependency job, ignoring: Access denied
Mar 06 02:38:54 tpc8 systemd[1233]: grub-boot-success.timer: Refusing to start, unit to trigger not loaded.
Mar 06 02:38:54 tpc8 systemd[1233]: Failed to start Mark boot as successful after the user session has run 2 minutes.
Mar 06 02:38:54 tpc8 systemd[1233]: Reached target Sockets.
Mar 06 02:38:54 tpc8 systemd[1233]: Reached target Timers.
Mar 06 02:38:54 tpc8 systemd[1233]: Reached target Paths.
Mar 06 02:38:54 tpc8 systemd[1233]: Reached target Basic System.
Mar 06 02:38:54 tpc8 systemd[1233]: Reached target Default.
Mar 06 02:38:54 tpc8 systemd[1233]: Startup finished in 206ms.
Mar 06 02:38:54 tpc8 systemd[1]: Started User Manager for UID 1006.
Mar 06 02:38:54 tpc8 sshd[1228]: pam_unix(sshd:session): session opened for user mike by (uid=0)
Mar 06 02:39:15 tpc8 sshd[1241]: Received disconnect from 192.168.1.112 port 56056:11: disconnected by user
Mar 06 02:39:15 tpc8 sshd[1241]: Disconnected from user mike 192.168.1.112 port 56056
Mar 06 02:39:15 tpc8 sshd[1228]: pam_unix(sshd:session): session closed for user mike
Mar 06 02:39:15 tpc8 systemd-logind[728]: Session 1 logged out. Waiting for processes to exit.
Mar 06 02:39:15 tpc8 systemd-logind[728]: Removed session 1.
Mar 06 02:39:15 tpc8 systemd[1]: user-runtime-dir@1006.service: Unit not needed anymore. Stopping.
Mar 06 02:39:15 tpc8 systemd[1]: Stopping User Manager for UID 1006...
Mar 06 02:39:15 tpc8 systemd[1233]: Failed to enqueue exit.target job: Access denied
Mar 06 02:40:14 tpc8 sshd[1244]: Accepted password for root from 192.168.1.107 port 50339 ssh2
Mar 06 02:40:14 tpc8 systemd[1]: Created slice User Slice of UID 0.
Mar 06 02:40:14 tpc8 systemd[1]: Started /run/user/0 mount wrapper.
Mar 06 02:40:14 tpc8 systemd[1]: Starting User Manager for UID 0...
Mar 06 02:40:14 tpc8 systemd-logind[728]: New session 3 of user root.
Mar 06 02:40:14 tpc8 systemd[1]: Started Session 3 of user root.
Mar 06 02:40:14 tpc8 systemd[1249]: pam_unix(systemd-user:session): session opened for user root by (uid=0)
Mar 06 02:40:15 tpc8 systemd[1249]: Reached target Paths.
Mar 06 02:40:15 tpc8 systemd[1249]: Reached target Timers.
Mar 06 02:40:15 tpc8 systemd[1249]: Starting D-Bus User Message Bus Socket.
Mar 06 02:40:15 tpc8 systemd[1249]: Listening on D-Bus User Message Bus Socket.
Mar 06 02:40:15 tpc8 systemd[1249]: Reached target Sockets.
Mar 06 02:40:15 tpc8 systemd[1249]: Reached target Basic System.
Mar 06 02:40:15 tpc8 systemd[1249]: Reached target Default.
Mar 06 02:40:15 tpc8 systemd[1249]: Startup finished in 188ms.
Mar 06 02:40:15 tpc8 systemd[1]: Started User Manager for UID 0.
Mar 06 02:40:15 tpc8 sshd[1244]: pam_unix(sshd:session): session opened for user root by (uid=0)

 Ming Wu <mingwu>
Fri 05 Mar 2021 09:10:38 PM UTC, comment #1: 

are you sure jk_chrootsh is actually started?

do you get any logging from jk_chrootsh if you ssh into the account?

do you get the same logging if you sftp to that account?


Olivier Sessink <oli4>
Group administrator
Fri 05 Mar 2021 04:08:19 PM UTC, original submission:  

Dear Authors of this wonder piece of software:

I followed steps at
https://olivier.sessink.nl/jailkit/howtos_sftp_scp_only.html
to create a sftp only account on CentOS 8.2 and found that the account is not limited to the jail:

I can use sftp client (such as psftp.exe from the PuTTY package or built-in sftp command in Ubuntu 20.04.2) to navigate to /var/www/html (my website files) and download everything there; my jail is at /home/jail, though.

This is bothering me for a long time. Hope someone can help me out!

Thanks,

Ming Wu


Ming Wu <mingwu>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by oli4 (Posted a comment)
  • -email is unavailable- added by mingwu (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-09-09 oli4 StatusNone Fixed

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-269c.
    Corresponding source code