lattera at gmail
Nov 17, 2009, 6:30 PM
Post #1 of 1
(677 views)
Permalink
|
Hi all,
Today, I was tasked at work with setting up a chroot SFTP server on a 64bit
Arch Linux server. I naturally turned to Arch Linux's wiki article on the
subject (http://wiki.archlinux.org/index.php/SFTP-chroot) and the directions
were very clear. However, the directions did not work. I kept getting a
"Write failed: Broken pipe" error after attempting to connect. Upon digging
through the code for OpenSSH 5.3p1 , I found this snippet of code, starting
at line 1399 of session.c and ending at line 1452:
/*
> * Chroot into a directory after checking it for safety: all path
> components
> * must be root-owned directories with strict permissions.
> */
> static void
> safely_chroot(const char *path, uid_t uid)
> {
> const char *cp;
> char component[MAXPATHLEN];
> struct stat st;
>
> if (*path != '/')
> fatal("chroot path does not begin at root");
> if (strlen(path) >= sizeof(component))
> fatal("chroot path too long");
>
> /*
> * Descend the path, checking that each component is a
> * root-owned directory with strict permissions.
> */
> for (cp = path; cp != NULL;) {
> if ((cp = strchr(cp, '/')) == NULL)
> strlcpy(component, path, sizeof(component));
> else {
> cp++;
> memcpy(component, path, cp - path);
> component[cp - path] = '\0';
> }
>
> debug3("%s: checking '%s'", __func__, component);
>
> if (stat(component, &st) != 0)
> fatal("%s: stat(\"%s\"): %s", __func__,
> component, strerror(errno));
> if (st.st_uid != 0 || (st.st_mode & 022) != 0)
> fatal("bad ownership or modes for chroot "
> "directory %s\"%s\"",
> cp == NULL ? "" : "component ", component);
> if (!S_ISDIR(st.st_mode))
> fatal("chroot path %s\"%s\" is not a directory",
> cp == NULL ? "" : "component ", component);
>
> }
>
> if (chdir(path) == -1)
> fatal("Unable to chdir to chroot path \"%s\": "
> "%s", path, strerror(errno));
> if (chroot(path) == -1)
> fatal("chroot(\"%s\"): %s", path, strerror(errno));
> if (chdir("/") == -1)
> fatal("%s: chdir(/) after chroot: %s",
> __func__, strerror(errno));
> verbose("Changed root directory to \"%s\"", path);
> }
>
Why should all the directory tree be root-owned and have that set of
permissions? This is preventing me from setting the chroot to /home/<user>
and be done with it, like that wiki article suggests. If there is no
security concern, I would like to remove the offending code (the for loop).
I will probably do this anyways for the project I'm working on, but I am
unsure if the public as a whole could benefit from such a change.
Thanks for taking the time to respond,
Shawn
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
|
