Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] chroot over ssh with pam_chroot

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Mathieu L." <lejatorn AT smgl.homelinux.net>
  • To: Seth Alan Woolley <seth AT positivism.org>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] chroot over ssh with pam_chroot
  • Date: Mon, 20 Dec 2004 02:04:46 +0100

On Sun, Dec 19, 2004 at 04:33:34PM -0800, Seth Alan Woolley wrote:
> Correct me if I'm wrong, but users in a chroot won't be able to change
> their own password easily. One would need a special setuid program that
> not only switches to root to edit /etc/passwd, but they would have to
> break out of the chroot before editing /etc/passwd, unless, of course,
> you're using some other finer-grained permission system such as that
> proposed by hans reiser where areas within a file can have their own
> permissions (and a hardlink could be created to a location inside the
> chroot). I believe dossen's other email should, however, get you hooked
> upon the username issue, though.
>
> I suppose you could copy the line from their chroot environment to the
> main passwd file with a cron script that checks for chroot passwd
> changed. However, I'm not sure exactly how you have things setup.
>
> Seth
>
> P.S. Personally, I would never allow a user the ability to change and
> create their own passwords without some password-hardness checks. I
> prefer issuing passwords that are changed annually. The old
> administrator where I work had passwords changed every month with a
> two-week warning of "password is about to expire". People just got into
> the habit of cycling numbers on the end of a very common word like the
> name of their pet or son/daughter. I had to put a stop to that.
>
> Most breakins I've seen are due to 1) unpatched software, 2)
> misconfigured software, and 3) social engineering passwords, and 4)
> guessing passwords. You'd be amazed how well guessing a password works,
> but more importantly telling people you will never ask for their
> password, ever.


Thanks for the reply.
This mailserver is only intended to host a few of my friends accounts
but I didn't want them to be able to wander all around the tree and I
thought the least they should have is a way to change their pass, as one
can do on a webmail.
As I don't want this to become too much of a hassle would you advise me
just to chroot them in their home with minimal power and to change
myself the pass and send it through gpged emails (to an alternate address
of course) when they require so?

Cheers,
Mathieu.




Archive powered by MHonArc 2.6.24.

Top of Page