[SM-Discuss] chroot over ssh with pam_chroot
Seth Alan Woolley
seth at positivism.org
Sun Dec 19 19:33:34 EST 2004
Correct me if I'm wrong, but users in a chroot won't be able to change
their own password easily. One would need a special setuid program that
not only switches to root to edit /etc/passwd, but they would have to
break out of the chroot before editing /etc/passwd, unless, of course,
you're using some other finer-grained permission system such as that
proposed by hans reiser where areas within a file can have their own
permissions (and a hardlink could be created to a location inside the
chroot). I believe dossen's other email should, however, get you hooked
upon the username issue, though.
I suppose you could copy the line from their chroot environment to the
main passwd file with a cron script that checks for chroot passwd
changed. However, I'm not sure exactly how you have things setup.
P.S. Personally, I would never allow a user the ability to change and
create their own passwords without some password-hardness checks. I
prefer issuing passwords that are changed annually. The old
administrator where I work had passwords changed every month with a
two-week warning of "password is about to expire". People just got into
the habit of cycling numbers on the end of a very common word like the
name of their pet or son/daughter. I had to put a stop to that.
Most breakins I've seen are due to 1) unpatched software, 2)
misconfigured software, and 3) social engineering passwords, and 4)
guessing passwords. You'd be amazed how well guessing a password works,
but more importantly telling people you will never ask for their
On Sun, Dec 19, 2004 at 01:08:19AM +0100, Mathieu L. wrote:
> Hi all,
> I am currently trying to set up a chrooted environment for ssh
> connections on my server. To achieve that I use the pam module
> pam_chroot (a spell for it is in test) since my sshd uses pam.
> It seems to work except that I get a "I have no name!" prompt because
> the chroot doesn't manage to know what's the username (though echo $USER
> returns fine). And this is a problem because the main purpose of this
> chroot environment is to allow mail users to change their password on
> the server (passwd won't work if the username is unknown!) among a few
> other actions. (cp, mv etc...)
> Please note that there is a etc/passwd in the chrooted directory.
> Actually, just to test, I even copied everything which was on the
> server's /etc into the chrooted directory but I still get the "I have no
> name prompt!".
> Also, I'm quite sure the problem is related to chroot itself and not to
> the pam module which uses it, because I have this problem even when I
> just chroot locally on the server.
> I have no clue on what's going on here; the usual logs don't show
> anything relevant and a strace of chroot didn't enlighten me either.
> Please let me know if you have any idea.
> SM-Discuss mailing list
> SM-Discuss at lists.ibiblio.org
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 189 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/sm-discuss/attachments/20041219/5943faf7/attachment.bin
More information about the SM-Discuss