Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] chroot over ssh with pam_chroot

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Mads Laursen <smgl AT dossen.dk>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] chroot over ssh with pam_chroot
  • Date: Mon, 20 Dec 2004 12:56:35 +0100

On 20/12/04 02.32, Mathieu L. wrote:
> On Mon, Dec 20, 2004 at 12:51:18AM +0100, Mads Laursen wrote:
>
> > It's been awfully long since I did any serious chrooting, but I seem
> > to recall that the "I have no name!" issue is related to the libraries
> > available in the current view of the filesystem.

Seems I'm a bit mistaken. I did a search for "I have no name" and LFS,
since that's where I remeber it from, and sure enough, it's in the
book[1]. It is supposed to be what you get when the current userid is
not in /etc/passwd. And from your original mail I recall that you
tried with a fully populated /etc.

> Of course I had ldded every bins I put in the chroot to know which libs
> I should copy, and subsequently copied those.

That should work, just remember to to check the libs as well, I think
they can have dependancies themselves (that are not listed by the
bins).

> I'm not even at the point where I have to worry about passwd itself
> since the user is not yet recognized.
> The unpacking solution seems odd, in all the docs I've read it was enough
> to cp a few bins like the shell plus what ldd returned for this bins, and
> /etc/passwd, group and shadow files. However I'll try that later and let
> you know how it turned out.

It should be enough, I was just coming from a "what are we forgetting"
angle and trying to reduce the number of unknowns.

1: http://howtos.linux.com/guides/html/chapter06/chroot.shtml

Anyway good luck with the project, chroot or not (I see you are
considering other options).

One option if passwd in a chroot shell does not work out, make a
CGI/php/whatever page to change passwords. Do whatever (serverside)
checks you want on them, hash them to somewhere (file...) (say,
username, passwordhash), and have a rootowned cronjob that checks the
file for users on an approved list and runs usermod for them. I do
something similar for a bunch of shellaccounts (except getting the
hashes via publickey-ssh from another system).

/dossen

Attachment: pgpWWslRyeXHq.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page