Add a New Comment Rich Markup
Right, It would defenitly help to have the 2 setups documented (either separate or compared against eachother). I have my information, but I think it would be very helpfull for others. When starting to configure the jail-kit for the first time, it feels like there are a lot of moving parts. But if you know a bit how things are working with eachother, it helps a lot for the overview. I feel like the additional docuemntation of the difference could help for some people getting this overview.
ahh now I understand the problem. The thing is: there are two valid sftp configurations with jailkit (possibly more): one with jk_lsh (if you only want to allow sftp) and one without jk_lsh (if you want to allow regular shell access and sftp). If I change the configuration of sftp for the first scenario, the second scenario doesn't work.. Should I improve the documentation somewhere to make this more clear?
So what I did (step-by-step) is the following. for the previous setup I called: jk_init -j /jail/dir uidbasics netbasics logbasics cvs git scp sftp ssh rsync extendedshell editors netutils (other calls jailing the user etc.) For fixing: 1. To add the missed but required jk_lsh call: jk_init -j /jail/dir jk_lsh 2. Edit the jk_lsh.ini to allow access to the sftp binaries through the jk_lsh (for some reason this is the only accessed shell, eventhough the jk_chroot shell is used for other ssh stuff). jk_lsh.ini added content >> ``` [DEFAULT] executables = /usr/bin/scp, /usr/lib/sftp-server, /usr/libexec/openssh/sftp-server, /usr/lib/misc/sftp-server, /usr/libexec/sftp-server, /usr/lib/openssh/sftp-server, /usr/bin/rsync, /usr/bin/ssh paths = /usr/bin/, /usr/lib allow_word_expansion = 1 ``` 3. Copy the jk_lsh.ini file to the '/jail/dir/etc/jailkit/' (either manually or using:) jk_update -j /jail/dir /etc/jailkit/jk_lsh.ini 4. Make sure the global shell configuration for the jailed user is set at 'jk_chrootsh' > i.e. in the '/etc/passwd' file usermod -s /usr/sbin/jk_chrootsh jail_user 5. Make sure the shell configuration in the jailed environment for the jailed user is set to the normal shell to make sure 'normal' ssh still works (rather than only restricting to jk_lsh). (simplest way is to manually edit the /jail/dir/etc/passwd file) jail_user:x:1001:1001:,,,:/home/jail_user:/bin/bash Hope this makes things clear. This was my way to fix the issue afterwards, but should be set by making sure the defaults are set correctly (see original post).
can you send the modifications to the config files you needed to get sftp working?
Goodday, I have been strugling to find the problem with getting sftp to work. I didn't find any good tutorials or documentation to follow, appart from those editing the 'sshd_config' file and so on. So maybe some documentation is in order as well? In essence most things work right from the start after a 'jk_init' call, unfortunately not sftp. For one the 'jk_lsh' is not included as 'includesections' in the 'jk_init.ini' file while the sftp utility actually depends on it. I only figured it out through watching the 'auth.log', a place most won't look for debugging. Secondly, when using the 'jk_lsh' utility, one should edit the 'jk_lsh.ini' file to include the allowed binaries (the sftp binaries in this case). One sidenote is that a 'jk_update' call is required to update the config files in a jail. I think this is more an improvement rather than a bug? Something which can partially be solved by editing the '.ini' files, and maybe some magic involving auto-adding the sftp executables to the 'jk_lsh.ini' file? Appart from that, some proper documentation on this would help a lot, since there is not much online documenting this properly. Kind Regards
(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)
Attach Files: Comment:
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Only logged-in users can vote.
Please enter the title of George Orwell's famous dystopian book (it's a date):
Copyright © 2023 Free Software Foundation, Inc. Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team. Source Code
Powered by Savane 3.12