bugJailkit - Bugs: bug #64649, sftp should include section jk_lsh

 
 

bug #64649: sftp should include section jk_lsh

Submitter:  N247S <n247s>
Submitted:  Sun 10 Sep 2023 09:14:03 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 02 Oct 2023 07:33:49 PM UTC, comment #4: 

Right,

It would defenitly help to have the 2 setups documented (either separate or compared against eachother).
I have my information, but I think it would be very helpfull for others.

When starting to configure the jail-kit for the first time, it feels like there are a lot of moving parts. But if you know a bit how things are working with eachother, it helps a lot for the overview. I feel like the additional docuemntation of the difference could help for some people getting this overview.

N247S <n247s>
Mon 02 Oct 2023 06:47:45 PM UTC, comment #3: 

ahh now I understand the problem.

The thing is: there are two valid sftp configurations with jailkit (possibly more): one with jk_lsh (if you only want to allow sftp) and one without jk_lsh (if you want to allow regular shell access and sftp).

If I change the configuration of sftp for the first scenario, the second scenario doesn't work..

Should I improve the documentation somewhere to make this more clear?


Olivier Sessink <oli4>
Group administrator
Mon 02 Oct 2023 05:09:52 PM UTC, comment #2: 

So what I did (step-by-step) is the following.

for the previous setup I called:
  jk_init -j /jail/dir uidbasics netbasics logbasics cvs git scp sftp ssh rsync extendedshell editors netutils
  (other calls jailing the user etc.)

For fixing:
1. To add the missed but required jk_lsh call:
  jk_init -j /jail/dir jk_lsh

2. Edit the jk_lsh.ini to allow access to the sftp binaries through the jk_lsh (for some reason this is the only accessed shell, eventhough the jk_chroot shell is used for other ssh stuff).
  jk_lsh.ini added content >>
  ```
  [DEFAULT]
  executables = /usr/bin/scp, /usr/lib/sftp-server,
/usr/libexec/openssh/sftp-server, /usr/lib/misc/sftp-server, /usr/libexec/sftp-server, /usr/lib/openssh/sftp-server, /usr/bin/rsync, /usr/bin/ssh
  paths = /usr/bin/, /usr/lib
  allow_word_expansion = 1
  ```
3. Copy the jk_lsh.ini file to the '/jail/dir/etc/jailkit/' (either manually or using:)
  jk_update -j /jail/dir /etc/jailkit/jk_lsh.ini

4. Make sure the global shell configuration for the jailed user is set at 'jk_chrootsh' > i.e. in the '/etc/passwd' file
  usermod -s /usr/sbin/jk_chrootsh jail_user

5. Make sure the shell configuration in the jailed environment for the jailed user is set to the normal shell to make sure 'normal' ssh still works (rather than only restricting to jk_lsh).
  (simplest way is to manually edit the /jail/dir/etc/passwd file)
  jail_user:x:1001:1001:,,,:/home/jail_user:/bin/bash

Hope this makes things clear.
This was my way to fix the issue afterwards, but should be set by making sure the defaults are set correctly (see original post).

N247S <n247s>
Sat 16 Sep 2023 08:46:47 PM UTC, comment #1: 

can you send the modifications to the config files you needed to get sftp working?

Olivier Sessink <oli4>
Group administrator
Sun 10 Sep 2023 09:14:03 AM UTC, original submission:  

Goodday,

I have been strugling to find the problem with getting sftp to work.

I didn't find any good tutorials or documentation to follow, appart from those editing the 'sshd_config' file and so on. So maybe some documentation is in order as well?

In essence most things work right from the start after a 'jk_init' call, unfortunately not sftp.

For one the 'jk_lsh' is not included as 'includesections' in the 'jk_init.ini' file while the sftp utility actually depends on it. I only figured it out through watching the 'auth.log', a place most won't look for debugging.
Secondly, when using the 'jk_lsh' utility, one should edit the 'jk_lsh.ini' file to include the allowed binaries (the sftp binaries in this case). One sidenote is that a 'jk_update' call is required to update the config files in a jail.

I think this is more an improvement rather than a bug? Something which can partially be solved by editing the '.ini' files, and maybe some magic involving auto-adding the sftp executables to the 'jk_lsh.ini' file?

Appart from that, some proper documentation on this would help a lot, since there is not much online documenting this properly.

Kind Regards


N247S <n247s>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by oli4 (Posted a comment)
  • -email is unavailable- added by n247s (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code