[{"data":1,"prerenderedAt":2514},["ShallowReactive",2],{"blog-\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux":3,"blog-\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux-surround":2459,"blog-\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux-certifications":2513},{"id":4,"title":5,"body":6,"categories":2448,"cover":2449,"cover_contain":1658,"credly_badge_id":2448,"date":2450,"description":2451,"extension":2452,"meta":2453,"navigation":1658,"path":2454,"related_certifications":2448,"seo":2455,"slug":2456,"stem":2457,"__hash__":2458},"blog\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux.md","Emprisonner un utilisateur ssh sous linux",{"type":7,"value":8,"toc":2438},"minimark",[9,14,18,22,78,91,95,98,158,196,203,230,234,243,246,268,271,287,290,304,307,351,354,366,376,392,399,447,452,465,475,490,493,527,530,543,553,571,577,589,592,611,618,845,848,867,875,887,893,902,911,926,936,972,978,982,996,999,1012,1017,1029,1039,1056,1059,1071,1078,1102,1114,1119,1128,1139,1142,1313,1320,1458,1461,1554,1557,1623,1626,1638,1641,2144,2147,2162,2168,2180,2186,2204,2210,2222,2225,2263,2266,2288,2291,2303,2317,2331,2342,2381,2384,2396,2402,2418,2424,2428,2434],[10,11,13],"h2",{"id":12},"cas-dusage-concret","Cas d'usage concret",[15,16,17],"p",{},"Vous devez restreindre un utilisateur SSH à un périmètre précis : voici comment mettre en place un chroot\u002Fjail sous Linux.",[10,19,21],{"id":20},"emprisonner-un-utilisateur","Emprisonner un utilisateur",[15,23,24,25,29,30,33,34,37,38,41,42,45,46,49,50,53,54,56,57,49,60,63,64,67,68,71,72,74,75,77],{},"Des ",[26,27,28],"strong",{},"projets communs"," peuvent amener parfois à donner des ",[26,31,32],{},"accès sur un serveur de production",".",[35,36],"br",{},"\nIl est difficile de donner l’",[26,39,40],{},"accès total"," du ",[26,43,44],{},"système"," à une société externe (",[26,47,48],{},"confidentialité","\u002F",[26,51,52],{},"sécurité",").",[35,55],{},"\nPour palier ce problème il existe le ",[26,58,59],{},"chroot",[26,61,62],{},"jail"," ou l’",[26,65,66],{},"emprisonnement"," d’un ",[26,69,70],{},"utilisateur"," dans un dossier.",[35,73],{},"\nLa vision complète de l’arborescence du serveur ne sera plus disponible pour cet utilisateur.",[35,76],{},"\nL’emprisonnement de celui-ci permet :",[79,80,81,85,88],"ul",{},[82,83,84],"li",{},"Une flexibilité accrue.",[82,86,87],{},"Une sécurité supplémentaire.",[82,89,90],{},"Fournir des accès plus facilement.",[10,92,94],{"id":93},"création-dun-environnement-fermé","Création d’un environnement fermé",[15,96,97],{},"La compréhension des étapes générales dans la création d’un chroot\u002Fjail sont importantes :",[99,100,101,109,118,124,131,138,144,151],"ol",{},[82,102,103,104,106,107,33],{},"Création d’un ",[26,105,70],{}," sur le ",[26,108,44],{},[82,110,111,112,41,115,33],{},"Création de l’",[26,113,114],{},"arborescence",[26,116,117],{},"répertoire prison",[82,119,120,121,33],{},"Ajouter un ",[26,122,123],{},"interpréteur de commandes",[82,125,126,127,130],{},"Montage de ",[26,128,129],{},"device"," (optionnel).",[82,132,133,134,137],{},"Modification de certains fichiers « ",[26,135,136],{},"\u002Fetc\u002F","« .",[82,139,140,141,33],{},"Création d’une fonction dit ",[26,142,143],{},"wrapper",[82,145,146,147,150],{},"Ajout des ",[26,148,149],{},"droits"," au fichier.",[82,152,153,154,157],{},"Ajout de ",[26,155,156],{},"commandes"," supplémentaire.",[15,159,160,161,164,165,33,174,176,177,180,181,183,184,187,188,191,192,195],{},"Pour plus d’informations sur la création d’un environnement pas à pas ",[26,162,163],{},"« chroot\u002Fjail »"," sur ",[166,167,171],"a",{"href":168,"rel":169},"http:\u002F\u002Flea-linux.org\u002Fdocumentations\u002FTrucs:Chrooter_un_utilisateur_%28ssh,_terminal,_console,_etc...%29",[170],"nofollow",[26,172,173],{},"léa-linux",[35,175],{},"\nCette méthode est relativement longue, nous allons plutôt utiliser des ",[26,178,179],{},"scripts"," déjà existants.",[35,182],{},"\nLes scripts que nous allons utiliser seront le ",[26,185,186],{},"Jailkit"," et",[26,189,190],{},"fuschlberger script"," sous ",[26,193,194],{},"Debian 7"," x64.",[15,197,198],{},[199,200],"img",{"alt":201,"src":202},"","\u002Fimages\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux\u002F1bd7f1453c.png",[15,204,205,206,33,209,211,212,219,220,227],{},"Le premier est un script clé en main toujours développé et plus évolué tandis que le second est vieillissant mais fonctionne tout aussi bien mais avec plus de difficultés sous la ",[26,207,208],{},"version 64 bits",[35,210],{},"\nPlus d’informations sur le site officiel du ",[166,213,216],{"href":214,"rel":215},"http:\u002F\u002Folivier.sessink.nl\u002Fjailkit\u002F",[170],[26,217,218],{},"jailkit"," ainsi que le site de ",[166,221,224],{"href":222,"rel":223},"http:\u002F\u002Fwww.fuschlberger.net\u002Fprograms\u002Fssh-scp-sftp-chroot-jail\u002F",[170],[26,225,226],{},"fuschlberger",[166,228,33],{"href":222,"rel":229},[170],[10,231,233],{"id":232},"le-script-jailkit","Le script Jailkit",[15,235,236,237,239,240,242],{},"Le ",[26,238,186],{}," est un script qui est maintenu et qui permet d’automatiser la construction d’une prison.",[35,241],{},"\nNous pourrons y ajouter un ou plusieurs utilisateurs afin de les restreindre.",[15,244,245],{},"Télécharger le script avec « wget » :",[247,248,252],"pre",{"className":249,"code":250,"language":251,"meta":201,"style":201},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","wget http:\u002F\u002Folivier.sessink.nl\u002Fjailkit\u002Fjailkit-2.17.tar.gz\n","bash",[253,254,255],"code",{"__ignoreMap":201},[256,257,260,264],"span",{"class":258,"line":259},"line",1,[256,261,263],{"class":262},"sBMFI","wget",[256,265,267],{"class":266},"sfazB"," http:\u002F\u002Folivier.sessink.nl\u002Fjailkit\u002Fjailkit-2.17.tar.gz\n",[15,269,270],{},"Décompresser le fichier :",[247,272,274],{"className":249,"code":273,"language":251,"meta":201,"style":201},"tar xvzf jailkit-2.17.tar.gz\n",[253,275,276],{"__ignoreMap":201},[256,277,278,281,284],{"class":258,"line":259},[256,279,280],{"class":262},"tar",[256,282,283],{"class":266}," xvzf",[256,285,286],{"class":266}," jailkit-2.17.tar.gz\n",[15,288,289],{},"Se rendre dans le dossier :",[247,291,293],{"className":249,"code":292,"language":251,"meta":201,"style":201},"cd jailkit-2.17\n",[253,294,295],{"__ignoreMap":201},[256,296,297,301],{"class":258,"line":259},[256,298,300],{"class":299},"s2Zo4","cd",[256,302,303],{"class":266}," jailkit-2.17\n",[15,305,306],{},"Exécuter la commande suivante :",[247,308,310],{"className":249,"code":309,"language":251,"meta":201,"style":201},".\u002Fdebian\u002Frules binary\n=> make[1]: quittant le répertoire « \u002Froot\u002Fjailkit-2.17 »\n",[253,311,312,320],{"__ignoreMap":201},[256,313,314,317],{"class":258,"line":259},[256,315,316],{"class":262},".\u002Fdebian\u002Frules",[256,318,319],{"class":266}," binary\n",[256,321,323,326,330,333,336,339,342,345,348],{"class":258,"line":322},2,[256,324,325],{"class":266},"=",[256,327,329],{"class":328},"sTEyZ","> ",[256,331,332],{"class":266},"make[1]:",[256,334,335],{"class":266}," quittant",[256,337,338],{"class":266}," le",[256,340,341],{"class":266}," répertoire",[256,343,344],{"class":266}," «",[256,346,347],{"class":266}," \u002Froot\u002Fjailkit-2.17",[256,349,350],{"class":266}," »\n",[15,352,353],{},"Sortir du répertoire actuel :",[247,355,357],{"className":249,"code":356,"language":251,"meta":201,"style":201},"cd ..\n",[253,358,359],{"__ignoreMap":201},[256,360,361,363],{"class":258,"line":259},[256,362,300],{"class":299},[256,364,365],{"class":266}," ..\n",[15,367,368,369,372,373,375],{},"Lancer l’",[26,370,371],{},"installation"," de ",[26,374,186],{}," :",[247,377,379],{"className":249,"code":378,"language":251,"meta":201,"style":201},"dpkg -i jailkit_2.17-1_amd64.deb\n",[253,380,381],{"__ignoreMap":201},[256,382,383,386,389],{"class":258,"line":259},[256,384,385],{"class":262},"dpkg",[256,387,388],{"class":266}," -i",[256,390,391],{"class":266}," jailkit_2.17-1_amd64.deb\n",[15,393,394,395,398],{},"On remarque que de nouvelles commandes sont disponibles : essayer de faire : « ",[26,396,397],{},"jk_","«",[247,400,402],{"className":249,"code":401,"language":251,"meta":201,"style":201},"jk_addjailuser   jk_chrootlaunch  jk_cp            jk_jailuser      jk_lsh           jk_uchroot       \njk_check         jk_chrootsh      jk_init          jk_list          jk_socketd       jk_update\n",[253,403,404,427],{"__ignoreMap":201},[256,405,406,409,412,415,418,421,424],{"class":258,"line":259},[256,407,408],{"class":262},"jk_addjailuser",[256,410,411],{"class":266},"   jk_chrootlaunch",[256,413,414],{"class":266},"  jk_cp",[256,416,417],{"class":266},"            jk_jailuser",[256,419,420],{"class":266},"      jk_lsh",[256,422,423],{"class":266},"           jk_uchroot",[256,425,426],{"class":328},"       \n",[256,428,429,432,435,438,441,444],{"class":258,"line":322},[256,430,431],{"class":262},"jk_check",[256,433,434],{"class":266},"         jk_chrootsh",[256,436,437],{"class":266},"      jk_init",[256,439,440],{"class":266},"          jk_list",[256,442,443],{"class":266},"          jk_socketd",[256,445,446],{"class":266},"       jk_update\n",[15,448,449,450,375],{},"Créer le ",[26,451,117],{},[247,453,455],{"className":249,"code":454,"language":251,"meta":201,"style":201},"mkdir \u002Fhome\u002Fjail\u002F\n",[253,456,457],{"__ignoreMap":201},[256,458,459,462],{"class":258,"line":259},[256,460,461],{"class":262},"mkdir",[256,463,464],{"class":266}," \u002Fhome\u002Fjail\u002F\n",[15,466,467,468,470,471,474],{},"Nous devons donner tous les ",[26,469,149],{}," à « ",[26,472,473],{},"root"," » :",[247,476,478],{"className":249,"code":477,"language":251,"meta":201,"style":201},"chown root:root \u002Fhome\u002Fjail\u002F\n",[253,479,480],{"__ignoreMap":201},[256,481,482,485,488],{"class":258,"line":259},[256,483,484],{"class":262},"chown",[256,486,487],{"class":266}," root:root",[256,489,464],{"class":266},[15,491,492],{},"Ajouter des programmes dans la prison :",[247,494,496],{"className":249,"code":495,"language":251,"meta":201,"style":201},"jk_init -v \u002Fhome\u002Fjail netutils basicshell jk_lsh ssh sftp editors\n",[253,497,498],{"__ignoreMap":201},[256,499,500,503,506,509,512,515,518,521,524],{"class":258,"line":259},[256,501,502],{"class":262},"jk_init",[256,504,505],{"class":266}," -v",[256,507,508],{"class":266}," \u002Fhome\u002Fjail",[256,510,511],{"class":266}," netutils",[256,513,514],{"class":266}," basicshell",[256,516,517],{"class":266}," jk_lsh",[256,519,520],{"class":266}," ssh",[256,522,523],{"class":266}," sftp",[256,525,526],{"class":266}," editors\n",[15,528,529],{},"Pour ajouter d’autres programmes il suffit d’éditer le fichier de configuration suivant :",[247,531,533],{"className":249,"code":532,"language":251,"meta":201,"style":201},"nano \u002Fetc\u002Fjailkit\u002Fjk_init.ini\n",[253,534,535],{"__ignoreMap":201},[256,536,537,540],{"class":258,"line":259},[256,538,539],{"class":262},"nano",[256,541,542],{"class":266}," \u002Fetc\u002Fjailkit\u002Fjk_init.ini\n",[15,544,545,546,549,550,474],{},"La copie des bibliothèques se fait avec la commande « ",[26,547,548],{},"jk_cp"," » exemple avec « ",[26,551,552],{},"mysql",[247,554,556],{"className":249,"code":555,"language":251,"meta":201,"style":201},"jk_cp -j \u002Fhome\u002Fjail\u002F \u002Fusr\u002Fbin\u002Fmysql\n",[253,557,558],{"__ignoreMap":201},[256,559,560,562,565,568],{"class":258,"line":259},[256,561,548],{"class":262},[256,563,564],{"class":266}," -j",[256,566,567],{"class":266}," \u002Fhome\u002Fjail\u002F",[256,569,570],{"class":266}," \u002Fusr\u002Fbin\u002Fmysql\n",[15,572,573,574,375],{},"Pour information, voici comment afficher ",[26,575,576],{},"les librairies d’un programme",[247,578,580],{"className":249,"code":579,"language":251,"meta":201,"style":201},"ldd \u002Fusr\u002Fbin\u002Fmysql\n",[253,581,582],{"__ignoreMap":201},[256,583,584,587],{"class":258,"line":259},[256,585,586],{"class":262},"ldd",[256,588,570],{"class":266},[15,590,591],{},"Si vous souhaitez utiliser mysql dans votre jail :",[247,593,595],{"className":249,"code":594,"language":251,"meta":201,"style":201},"mount --bind \u002Fvar\u002Frun\u002Fmysqld\u002F \u002Fvotre\u002Fprison\u002Fvar\u002Frun\u002Fmysqld\u002F\n",[253,596,597],{"__ignoreMap":201},[256,598,599,602,605,608],{"class":258,"line":259},[256,600,601],{"class":262},"mount",[256,603,604],{"class":266}," --bind",[256,606,607],{"class":266}," \u002Fvar\u002Frun\u002Fmysqld\u002F",[256,609,610],{"class":266}," \u002Fvotre\u002Fprison\u002Fvar\u002Frun\u002Fmysqld\u002F\n",[15,612,613,614,617],{},"Créer l’utilisateur qui sera « ",[26,615,616],{},"chrooté"," » dans sa prison :",[247,619,621],{"className":249,"code":620,"language":251,"meta":201,"style":201},"adduser jeremie\n=>Ajout de l'utilisateur « jeremie » ...\nAjout du nouveau groupe « jeremie » (1001) ...\nAjout du nouvel utilisateur « jeremie » (1001) avec le groupe « jeremie » ...\nCréation du répertoire personnel « \u002Fhome\u002Fjeremie»...\nCopie des fichiers depuis « \u002Fetc\u002Fskel »...\nEntrez le nouveau mot de passe UNIX :\nRetapez le nouveau mot de passe UNIX :\npasswd : le mot de passe a été mis à jour avec succès\nModification des informations relatives à l'utilisateur jeremie\nEntrez la nouvelle valeur ou « Entrée » pour conserver la valeur proposée\n        Nom complet []: Jérémie Kassianoff\n        N° de bureau []:\n        Téléphone professionnel []:\n        Téléphone personnel []:\n        Autre []:\nchfn : nom contenant des caractères non ASCII : Jérémie Kassianoff\nCette information est-elle correcte ? [O\u002Fn]O\n",[253,622,623,631,654,660,666,672,678,684,690,696,708,742,754,768,779,789,797,827],{"__ignoreMap":201},[256,624,625,628],{"class":258,"line":259},[256,626,627],{"class":262},"adduser",[256,629,630],{"class":266}," jeremie\n",[256,632,633,635,638,641,644,647,651],{"class":258,"line":322},[256,634,325],{"class":266},[256,636,637],{"class":328},">",[256,639,640],{"class":266},"Ajout",[256,642,643],{"class":266}," de",[256,645,646],{"class":266}," l",[256,648,650],{"class":649},"sMK4o","'",[256,652,653],{"class":266},"utilisateur « jeremie » ...\n",[256,655,657],{"class":258,"line":656},3,[256,658,659],{"class":266},"Ajout du nouveau groupe « jeremie » (1001) ...\n",[256,661,663],{"class":258,"line":662},4,[256,664,665],{"class":266},"Ajout du nouvel utilisateur « jeremie » (1001) avec le groupe « jeremie » ...\n",[256,667,669],{"class":258,"line":668},5,[256,670,671],{"class":266},"Création du répertoire personnel « \u002Fhome\u002Fjeremie»...\n",[256,673,675],{"class":258,"line":674},6,[256,676,677],{"class":266},"Copie des fichiers depuis « \u002Fetc\u002Fskel »...\n",[256,679,681],{"class":258,"line":680},7,[256,682,683],{"class":266},"Entrez le nouveau mot de passe UNIX :\n",[256,685,687],{"class":258,"line":686},8,[256,688,689],{"class":266},"Retapez le nouveau mot de passe UNIX :\n",[256,691,693],{"class":258,"line":692},9,[256,694,695],{"class":266},"passwd : le mot de passe a été mis à jour avec succès\n",[256,697,699,702,704,706],{"class":258,"line":698},10,[256,700,701],{"class":266},"Modification des informations relatives à l",[256,703,650],{"class":649},[256,705,70],{"class":266},[256,707,630],{"class":266},[256,709,711,714,717,720,723,726,729,732,735,737,739],{"class":258,"line":710},11,[256,712,713],{"class":262},"Entrez",[256,715,716],{"class":266}," la",[256,718,719],{"class":266}," nouvelle",[256,721,722],{"class":266}," valeur",[256,724,725],{"class":266}," ou",[256,727,728],{"class":266}," « Entrée »",[256,730,731],{"class":266}," pour",[256,733,734],{"class":266}," conserver",[256,736,716],{"class":266},[256,738,722],{"class":266},[256,740,741],{"class":266}," proposée\n",[256,743,745,748,751],{"class":258,"line":744},12,[256,746,747],{"class":262},"        Nom",[256,749,750],{"class":266}," complet",[256,752,753],{"class":328}," []: Jérémie Kassianoff\n",[256,755,757,760,762,765],{"class":258,"line":756},13,[256,758,759],{"class":262},"        N°",[256,761,643],{"class":266},[256,763,764],{"class":266}," bureau",[256,766,767],{"class":328}," []:\n",[256,769,771,774,777],{"class":258,"line":770},14,[256,772,773],{"class":262},"        Téléphone",[256,775,776],{"class":266}," professionnel",[256,778,767],{"class":328},[256,780,782,784,787],{"class":258,"line":781},15,[256,783,773],{"class":262},[256,785,786],{"class":266}," personnel",[256,788,767],{"class":328},[256,790,792,795],{"class":258,"line":791},16,[256,793,794],{"class":262},"        Autre",[256,796,767],{"class":328},[256,798,800,803,806,809,812,815,818,821,824],{"class":258,"line":799},17,[256,801,802],{"class":262},"chfn :",[256,804,805],{"class":266}," nom",[256,807,808],{"class":266}," contenant",[256,810,811],{"class":266}," des",[256,813,814],{"class":266}," caractères",[256,816,817],{"class":266}," non",[256,819,820],{"class":266}," ASCII :",[256,822,823],{"class":266}," Jérémie",[256,825,826],{"class":266}," Kassianoff\n",[256,828,830,833,836,839,842],{"class":258,"line":829},18,[256,831,832],{"class":262},"Cette",[256,834,835],{"class":266}," information",[256,837,838],{"class":266}," est-elle",[256,840,841],{"class":266}," correcte ?",[256,843,844],{"class":328}," [O\u002Fn]O\n",[15,846,847],{},"On ajoute l’utilisateur dans la prison avec la commande suivante :",[247,849,851],{"className":249,"code":850,"language":251,"meta":201,"style":201},"jk_jailuser -m -j \u002Fhome\u002Fjail\u002F jeremie\n",[253,852,853],{"__ignoreMap":201},[256,854,855,858,861,863,865],{"class":258,"line":259},[256,856,857],{"class":262},"jk_jailuser",[256,859,860],{"class":266}," -m",[256,862,564],{"class":266},[256,864,567],{"class":266},[256,866,630],{"class":266},[15,868,869,870,872,873,474],{},"Éditer le fichier des utilisateurs existants sur le ",[26,871,44],{}," « ",[26,874,62],{},[247,876,878],{"className":249,"code":877,"language":251,"meta":201,"style":201},"nano \u002Fhome\u002Fjail\u002Fetc\u002Fpasswd\n",[253,879,880],{"__ignoreMap":201},[256,881,882,884],{"class":258,"line":259},[256,883,539],{"class":262},[256,885,886],{"class":266}," \u002Fhome\u002Fjail\u002Fetc\u002Fpasswd\n",[15,888,889,890,474],{},"Retrouvez votre utilisateur et modifier votre « ",[26,891,892],{},"shell",[247,894,896],{"className":249,"code":895,"language":251,"meta":201,"style":201},"jeremie:x:1001:1001:,,,:\u002Fhome\u002Fjeremie:\u002Fbin\u002Fbash\n",[253,897,898],{"__ignoreMap":201},[256,899,900],{"class":258,"line":259},[256,901,895],{"class":262},[15,903,904,905,908,909,375],{},"Vous pouvez maintenant vous ",[26,906,907],{},"loguer"," avec votre ",[26,910,70],{},[247,912,914],{"className":249,"code":913,"language":251,"meta":201,"style":201},"su - jeremie\n",[253,915,916],{"__ignoreMap":201},[256,917,918,921,924],{"class":258,"line":259},[256,919,920],{"class":262},"su",[256,922,923],{"class":266}," -",[256,925,630],{"class":266},[15,927,928,929,932,933,375],{},"Affichez la ",[26,930,931],{},"racine"," de la ",[26,934,935],{},"prison",[247,937,939],{"className":249,"code":938,"language":251,"meta":201,"style":201},"ls \u002F\nbin  dev  etc  home  lib  lib64  usr\n",[253,940,941,949],{"__ignoreMap":201},[256,942,943,946],{"class":258,"line":259},[256,944,945],{"class":262},"ls",[256,947,948],{"class":266}," \u002F\n",[256,950,951,954,957,960,963,966,969],{"class":258,"line":322},[256,952,953],{"class":262},"bin ",[256,955,956],{"class":266}," dev ",[256,958,959],{"class":266}," etc ",[256,961,962],{"class":266}," home ",[256,964,965],{"class":266}," lib ",[256,967,968],{"class":266}," lib64 ",[256,970,971],{"class":266}," usr\n",[15,973,974,975,977],{},"L’introduction sur le ",[26,976,218],{}," est terminée.",[10,979,981],{"id":980},"le-script-fuschlberger","Le script fuschlberger",[15,983,236,984,372,987,989,990,992,993,995],{},[26,985,986],{},"script",[26,988,226],{}," est assez vieux (2008) mais il fonctionne encore très bien.",[35,991],{},"\nNous allons le faire fonctionner sous ",[26,994,194],{}," en version 64 bits.",[15,997,998],{},"Avant toute chose vérifiez que vous avez bien les paquets suivants d’installés :",[247,1000,1002],{"className":249,"code":1001,"language":251,"meta":201,"style":201},"debianutils coreutils\n",[253,1003,1004],{"__ignoreMap":201},[256,1005,1006,1009],{"class":258,"line":259},[256,1007,1008],{"class":262},"debianutils",[256,1010,1011],{"class":266}," coreutils\n",[15,1013,1014,1015,474],{},"Télécharger le script avec « ",[26,1016,263],{},[247,1018,1020],{"className":249,"code":1019,"language":251,"meta":201,"style":201},"wget http:\u002F\u002Fwww.fuschlberger.net\u002Fprograms\u002Fssh-scp-sftp-chroot-jail\u002Fmake_chroot_jail.sh\n",[253,1021,1022],{"__ignoreMap":201},[256,1023,1024,1026],{"class":258,"line":259},[256,1025,263],{"class":262},[256,1027,1028],{"class":266}," http:\u002F\u002Fwww.fuschlberger.net\u002Fprograms\u002Fssh-scp-sftp-chroot-jail\u002Fmake_chroot_jail.sh\n",[15,1030,1031,1032,1035,1036,1038],{},"Rendre ",[26,1033,1034],{},"exécutable"," le ",[26,1037,986],{},":",[247,1040,1042],{"className":249,"code":1041,"language":251,"meta":201,"style":201},"chmod 770 make_chroot_jail.sh\n",[253,1043,1044],{"__ignoreMap":201},[256,1045,1046,1049,1053],{"class":258,"line":259},[256,1047,1048],{"class":262},"chmod",[256,1050,1052],{"class":1051},"sbssI"," 770",[256,1054,1055],{"class":266}," make_chroot_jail.sh\n",[15,1057,1058],{},"Lancer le script (version simplifiée) :",[247,1060,1062],{"className":249,"code":1061,"language":251,"meta":201,"style":201},"make_chroot_jail.sh jeremie\n",[253,1063,1064],{"__ignoreMap":201},[256,1065,1066,1069],{"class":258,"line":259},[256,1067,1068],{"class":262},"make_chroot_jail.sh",[256,1070,630],{"class":266},[15,1072,1073,1074,1077],{},"Par défaut la prison se trouvera dans « ",[26,1075,1076],{},"\u002Fhome\u002Fjail"," » si vous souhaitez changer le répertoire :",[247,1079,1081],{"className":249,"code":1080,"language":251,"meta":201,"style":201},"make_chroot_jail.sh jeremie [\u002Fchemin\u002Fshell] [\u002Fchemin\u002Fprison]\n",[253,1082,1083],{"__ignoreMap":201},[256,1084,1085,1087,1090,1093,1096,1099],{"class":258,"line":259},[256,1086,1068],{"class":262},[256,1088,1089],{"class":266}," jeremie",[256,1091,1092],{"class":328}," [\u002Fchemin\u002Fshell] ",[256,1094,1095],{"class":649},"[",[256,1097,1098],{"class":328},"\u002Fchemin\u002Fprison",[256,1100,1101],{"class":649},"]\n",[15,1103,1104,1105,1108,1109,33,1111,1113],{},"Si vous lancez l’exécution du script, vous aurez très certainement une ",[26,1106,1107],{},"erreur"," sous la ",[26,1110,208],{},[35,1112],{},"\nC’est maintenant que nous allons commencer à modifier certaines valeurs dans le script.",[1115,1116,1118],"h3",{"id":1117},"erreurs-sous-debian-7-version-x64","Erreurs sous Debian 7 version X64",[15,1120,1121,1122,1124,1125],{},"Lors de la première exécution du script (x64) vous avez du voir apparaître des erreurs.",[35,1123],{},"\nPour résoudre la première erreur (ligne 406 & 407), il faut ",[26,1126,1127],{},"éditer le script fuschlberger :",[247,1129,1131],{"className":249,"code":1130,"language":251,"meta":201,"style":201},"nano make_chroot_jail.sh\n",[253,1132,1133],{"__ignoreMap":201},[256,1134,1135,1137],{"class":258,"line":259},[256,1136,539],{"class":262},[256,1138,1055],{"class":266},[15,1140,1141],{},"Puis retrouver les deux lignes suivantes :",[247,1143,1145],{"className":249,"code":1144,"language":251,"meta":201,"style":201},"TMPFILE1=`mktemp` &> \u002Fdev\u002Fnull ||  TMPFILE1=\"${HOME}\u002Fldlist\"; if [ -x ${TMPFILE1} ]; then mv ${TMPFILE1} ${TMPFILE1}.bak;fi\nTMPFILE2=`mktemp` &> \u002Fdev\u002Fnull ||  TMPFILE2=\"${HOME}\u002Fldlist2\"; if [ -x ${TMPFILE2} ]; then mv ${TMPFILE2} ${TMPFILE2}.bak;fi\n",[253,1146,1147,1240],{"__ignoreMap":201},[256,1148,1149,1152,1154,1157,1160,1162,1165,1168,1171,1174,1176,1179,1182,1185,1188,1191,1194,1198,1201,1204,1207,1209,1211,1214,1217,1220,1222,1224,1226,1228,1230,1232,1235,1237],{"class":258,"line":259},[256,1150,1151],{"class":328},"TMPFILE1",[256,1153,325],{"class":649},[256,1155,1156],{"class":649},"`",[256,1158,1159],{"class":262},"mktemp",[256,1161,1156],{"class":649},[256,1163,1164],{"class":649}," &>",[256,1166,1167],{"class":328}," \u002Fdev\u002Fnull ",[256,1169,1170],{"class":649},"||",[256,1172,1173],{"class":328},"  TMPFILE1",[256,1175,325],{"class":649},[256,1177,1178],{"class":649},"\"${",[256,1180,1181],{"class":328},"HOME",[256,1183,1184],{"class":649},"}",[256,1186,1187],{"class":266},"\u002Fldlist",[256,1189,1190],{"class":649},"\"",[256,1192,1193],{"class":649},";",[256,1195,1197],{"class":1196},"s7zQu"," if",[256,1199,1200],{"class":649}," [",[256,1202,1203],{"class":649}," -x",[256,1205,1206],{"class":649}," ${",[256,1208,1151],{"class":328},[256,1210,1184],{"class":649},[256,1212,1213],{"class":649}," ];",[256,1215,1216],{"class":1196}," then",[256,1218,1219],{"class":262}," mv",[256,1221,1206],{"class":649},[256,1223,1151],{"class":328},[256,1225,1184],{"class":649},[256,1227,1206],{"class":649},[256,1229,1151],{"class":328},[256,1231,1184],{"class":649},[256,1233,1234],{"class":266},".bak",[256,1236,1193],{"class":649},[256,1238,1239],{"class":1196},"fi\n",[256,1241,1242,1245,1247,1249,1251,1253,1255,1257,1259,1262,1264,1266,1268,1270,1273,1275,1277,1279,1281,1283,1285,1287,1289,1291,1293,1295,1297,1299,1301,1303,1305,1307,1309,1311],{"class":258,"line":322},[256,1243,1244],{"class":328},"TMPFILE2",[256,1246,325],{"class":649},[256,1248,1156],{"class":649},[256,1250,1159],{"class":262},[256,1252,1156],{"class":649},[256,1254,1164],{"class":649},[256,1256,1167],{"class":328},[256,1258,1170],{"class":649},[256,1260,1261],{"class":328},"  TMPFILE2",[256,1263,325],{"class":649},[256,1265,1178],{"class":649},[256,1267,1181],{"class":328},[256,1269,1184],{"class":649},[256,1271,1272],{"class":266},"\u002Fldlist2",[256,1274,1190],{"class":649},[256,1276,1193],{"class":649},[256,1278,1197],{"class":1196},[256,1280,1200],{"class":649},[256,1282,1203],{"class":649},[256,1284,1206],{"class":649},[256,1286,1244],{"class":328},[256,1288,1184],{"class":649},[256,1290,1213],{"class":649},[256,1292,1216],{"class":1196},[256,1294,1219],{"class":262},[256,1296,1206],{"class":649},[256,1298,1244],{"class":328},[256,1300,1184],{"class":649},[256,1302,1206],{"class":649},[256,1304,1244],{"class":328},[256,1306,1184],{"class":649},[256,1308,1234],{"class":266},[256,1310,1193],{"class":649},[256,1312,1239],{"class":1196},[15,1314,1315,1316,1319],{},"Il faut alors supprimer « ",[26,1317,1318],{},"\u002Fdev\u002Fnull"," »  comme ceci :",[247,1321,1323],{"className":249,"code":1322,"language":251,"meta":201,"style":201},"TMPFILE1=`mktemp` ||  TMPFILE1=\"${HOME}\u002Fldlist\"; if [ -x ${TMPFILE1} ]; then mv ${TMPFILE1} ${TMPFILE1}.bak;fi\nTMPFILE2=`mktemp` ||  TMPFILE2=\"${HOME}\u002Fldlist2\"; if [ -x ${TMPFILE2} ]; then mv ${TMPFILE2} ${TMPFILE2}.bak;fi\n",[253,1324,1325,1392],{"__ignoreMap":201},[256,1326,1327,1329,1331,1333,1335,1337,1340,1342,1344,1346,1348,1350,1352,1354,1356,1358,1360,1362,1364,1366,1368,1370,1372,1374,1376,1378,1380,1382,1384,1386,1388,1390],{"class":258,"line":259},[256,1328,1151],{"class":328},[256,1330,325],{"class":649},[256,1332,1156],{"class":649},[256,1334,1159],{"class":262},[256,1336,1156],{"class":649},[256,1338,1339],{"class":649}," ||",[256,1341,1173],{"class":328},[256,1343,325],{"class":649},[256,1345,1178],{"class":649},[256,1347,1181],{"class":328},[256,1349,1184],{"class":649},[256,1351,1187],{"class":266},[256,1353,1190],{"class":649},[256,1355,1193],{"class":649},[256,1357,1197],{"class":1196},[256,1359,1200],{"class":649},[256,1361,1203],{"class":649},[256,1363,1206],{"class":649},[256,1365,1151],{"class":328},[256,1367,1184],{"class":649},[256,1369,1213],{"class":649},[256,1371,1216],{"class":1196},[256,1373,1219],{"class":262},[256,1375,1206],{"class":649},[256,1377,1151],{"class":328},[256,1379,1184],{"class":649},[256,1381,1206],{"class":649},[256,1383,1151],{"class":328},[256,1385,1184],{"class":649},[256,1387,1234],{"class":266},[256,1389,1193],{"class":649},[256,1391,1239],{"class":1196},[256,1393,1394,1396,1398,1400,1402,1404,1406,1408,1410,1412,1414,1416,1418,1420,1422,1424,1426,1428,1430,1432,1434,1436,1438,1440,1442,1444,1446,1448,1450,1452,1454,1456],{"class":258,"line":322},[256,1395,1244],{"class":328},[256,1397,325],{"class":649},[256,1399,1156],{"class":649},[256,1401,1159],{"class":262},[256,1403,1156],{"class":649},[256,1405,1339],{"class":649},[256,1407,1261],{"class":328},[256,1409,325],{"class":649},[256,1411,1178],{"class":649},[256,1413,1181],{"class":328},[256,1415,1184],{"class":649},[256,1417,1272],{"class":266},[256,1419,1190],{"class":649},[256,1421,1193],{"class":649},[256,1423,1197],{"class":1196},[256,1425,1200],{"class":649},[256,1427,1203],{"class":649},[256,1429,1206],{"class":649},[256,1431,1244],{"class":328},[256,1433,1184],{"class":649},[256,1435,1213],{"class":649},[256,1437,1216],{"class":1196},[256,1439,1219],{"class":262},[256,1441,1206],{"class":649},[256,1443,1244],{"class":328},[256,1445,1184],{"class":649},[256,1447,1206],{"class":649},[256,1449,1244],{"class":328},[256,1451,1184],{"class":649},[256,1453,1234],{"class":266},[256,1455,1193],{"class":649},[256,1457,1239],{"class":1196},[15,1459,1460],{},"Le second problème se trouve dans le chemin des librairies :",[247,1462,1464],{"className":249,"code":1463,"language":251,"meta":201,"style":201},"elif [ \"$DISTRO\" = DEBIAN ]; then\n  cp \u002Flib\u002Flibnss_compat.so.2 \u002Flib\u002Flibnsl.so.1 \u002Flib\u002Flibnss_files.so.2 \u002Flib\u002Flibcap.so.1 \u002Flib\u002Flibnss_dns.so.2 ${JAILPATH}\u002Flib\u002F\nelse\n  cp \u002Flib\u002Flibnss_compat.so.2 \u002Flib\u002Flibnsl.so.1 \u002Flib\u002Flibnss_files.so.2 \u002Flib\u002Flibcap.so.1 \u002Flib\u002Flibnss_dns.so.2 ${JAILPATH}\u002Flib\u002F\nfi\n",[253,1465,1466,1493,1523,1528,1550],{"__ignoreMap":201},[256,1467,1468,1471,1473,1476,1479,1481,1484,1487,1490],{"class":258,"line":259},[256,1469,1470],{"class":1196},"elif",[256,1472,1200],{"class":649},[256,1474,1475],{"class":649}," \"",[256,1477,1478],{"class":328},"$DISTRO",[256,1480,1190],{"class":649},[256,1482,1483],{"class":649}," =",[256,1485,1486],{"class":328}," DEBIAN ",[256,1488,1489],{"class":649},"];",[256,1491,1492],{"class":1196}," then\n",[256,1494,1495,1498,1501,1504,1507,1510,1513,1515,1518,1520],{"class":258,"line":322},[256,1496,1497],{"class":262},"  cp",[256,1499,1500],{"class":266}," \u002Flib\u002Flibnss_compat.so.2",[256,1502,1503],{"class":266}," \u002Flib\u002Flibnsl.so.1",[256,1505,1506],{"class":266}," \u002Flib\u002Flibnss_files.so.2",[256,1508,1509],{"class":266}," \u002Flib\u002Flibcap.so.1",[256,1511,1512],{"class":266}," \u002Flib\u002Flibnss_dns.so.2",[256,1514,1206],{"class":649},[256,1516,1517],{"class":328},"JAILPATH",[256,1519,1184],{"class":649},[256,1521,1522],{"class":266},"\u002Flib\u002F\n",[256,1524,1525],{"class":258,"line":656},[256,1526,1527],{"class":1196},"else\n",[256,1529,1530,1532,1534,1536,1538,1540,1542,1544,1546,1548],{"class":258,"line":662},[256,1531,1497],{"class":262},[256,1533,1500],{"class":266},[256,1535,1503],{"class":266},[256,1537,1506],{"class":266},[256,1539,1509],{"class":266},[256,1541,1512],{"class":266},[256,1543,1206],{"class":649},[256,1545,1517],{"class":328},[256,1547,1184],{"class":649},[256,1549,1522],{"class":266},[256,1551,1552],{"class":258,"line":668},[256,1553,1239],{"class":1196},[15,1555,1556],{},"On se retrouve avec des chemins pour la version x86, il faut donc les adapter à notre système x64 :",[247,1558,1560],{"className":249,"code":1559,"language":251,"meta":201,"style":201},"elif [ \"$DISTRO\" = DEBIAN ]; then\n  cp \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_compat.so.2 \u002Flib\u002Fx86_64-linux-gnu\u002Flibnsl.so.1 \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_files.so.2 \u002Flib\u002Fx86_64-linux-$\nelse\n  cp \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_compat.so.2 \u002Flib\u002Fx86_64-linux-gnu\u002Flibnsl.so.1 \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_files.so.2 \u002Flib\u002Fx86_64-linux-$\nfi\n",[253,1561,1562,1582,1601,1605,1619],{"__ignoreMap":201},[256,1563,1564,1566,1568,1570,1572,1574,1576,1578,1580],{"class":258,"line":259},[256,1565,1470],{"class":1196},[256,1567,1200],{"class":649},[256,1569,1475],{"class":649},[256,1571,1478],{"class":328},[256,1573,1190],{"class":649},[256,1575,1483],{"class":649},[256,1577,1486],{"class":328},[256,1579,1489],{"class":649},[256,1581,1492],{"class":1196},[256,1583,1584,1586,1589,1592,1595,1598],{"class":258,"line":322},[256,1585,1497],{"class":262},[256,1587,1588],{"class":266}," \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_compat.so.2",[256,1590,1591],{"class":266}," \u002Flib\u002Fx86_64-linux-gnu\u002Flibnsl.so.1",[256,1593,1594],{"class":266}," \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_files.so.2",[256,1596,1597],{"class":266}," \u002Flib\u002Fx86_64-linux-",[256,1599,1600],{"class":328},"$\n",[256,1602,1603],{"class":258,"line":656},[256,1604,1527],{"class":1196},[256,1606,1607,1609,1611,1613,1615,1617],{"class":258,"line":662},[256,1608,1497],{"class":262},[256,1610,1588],{"class":266},[256,1612,1591],{"class":266},[256,1614,1594],{"class":266},[256,1616,1597],{"class":266},[256,1618,1600],{"class":328},[256,1620,1621],{"class":258,"line":668},[256,1622,1239],{"class":1196},[15,1624,1625],{},"Une fois les problèmes réglés, relancez le script avec la commande :",[247,1627,1629],{"className":249,"code":1628,"language":251,"meta":201,"style":201}," make_chroot_jail.sh jeremie\n",[253,1630,1631],{"__ignoreMap":201},[256,1632,1633,1636],{"class":258,"line":259},[256,1634,1635],{"class":262}," make_chroot_jail.sh",[256,1637,630],{"class":266},[15,1639,1640],{},"Ensuite, le résultat de la commande vous affichera :",[247,1642,1644],{"className":249,"code":1643,"language":251,"meta":201,"style":201}," Release: 2008-04-26\n\nAm I root?\n  OK\nChecking distribution...\n  Supported Distribution found\n  System is running Debian Linux\nChecking for which...\n  OK\nChecking for chroot...\n  OK\nChecking for sudo...\n  OK\nChecking for dirname...\n  OK\nChecking for awk...\n  OK\n\nSubsystem sftp \u002Fusr\u002Flib\u002Fopenssh\u002Fsftp-server\n\n-----------------------------\nThe file \u002Fbin\u002Fchroot-shell exists.\nProbably it was created by this script.\n\nAre you sure you want to overwrite it?\n(you want to say yes for example if you are running the script for the second\ntime when adding more than one account to the jail)\n(yes\u002Fno) -> yes\n\nModifying \u002Fetc\u002Fsudoers\nAdding User \"jeremie\" to system\nEntrez le nouveau mot de passe UNIX :\nRetapez le nouveau mot de passe UNIX :\npasswd : le mot de passe a été mis à jour avec succès\n\nAdding User jeremie to jail\nCopying necessary library-files to jail (may take some time)\nCopying files from \u002Fetc\u002Fpam.d\u002F to jail\nCopying PAM-Modules to jail\n",[253,1645,1646,1654,1660,1671,1676,1684,1695,1712,1722,1726,1735,1739,1748,1752,1761,1765,1774,1778,1782,1793,1798,1804,1819,1843,1848,1874,1920,1932,1950,1955,1964,1985,2009,2029,2064,2069,2083,2114,2132],{"__ignoreMap":201},[256,1647,1648,1651],{"class":258,"line":259},[256,1649,1650],{"class":262}," Release:",[256,1652,1653],{"class":266}," 2008-04-26\n",[256,1655,1656],{"class":258,"line":322},[256,1657,1659],{"emptyLinePlaceholder":1658},true,"\n",[256,1661,1662,1665,1668],{"class":258,"line":656},[256,1663,1664],{"class":262},"Am",[256,1666,1667],{"class":266}," I",[256,1669,1670],{"class":266}," root?\n",[256,1672,1673],{"class":258,"line":662},[256,1674,1675],{"class":262},"  OK\n",[256,1677,1678,1681],{"class":258,"line":668},[256,1679,1680],{"class":262},"Checking",[256,1682,1683],{"class":266}," distribution...\n",[256,1685,1686,1689,1692],{"class":258,"line":674},[256,1687,1688],{"class":262},"  Supported",[256,1690,1691],{"class":266}," Distribution",[256,1693,1694],{"class":266}," found\n",[256,1696,1697,1700,1703,1706,1709],{"class":258,"line":680},[256,1698,1699],{"class":262},"  System",[256,1701,1702],{"class":266}," is",[256,1704,1705],{"class":266}," running",[256,1707,1708],{"class":266}," Debian",[256,1710,1711],{"class":266}," Linux\n",[256,1713,1714,1716,1719],{"class":258,"line":686},[256,1715,1680],{"class":262},[256,1717,1718],{"class":266}," for",[256,1720,1721],{"class":266}," which...\n",[256,1723,1724],{"class":258,"line":692},[256,1725,1675],{"class":262},[256,1727,1728,1730,1732],{"class":258,"line":698},[256,1729,1680],{"class":262},[256,1731,1718],{"class":266},[256,1733,1734],{"class":266}," chroot...\n",[256,1736,1737],{"class":258,"line":710},[256,1738,1675],{"class":262},[256,1740,1741,1743,1745],{"class":258,"line":744},[256,1742,1680],{"class":262},[256,1744,1718],{"class":266},[256,1746,1747],{"class":266}," sudo...\n",[256,1749,1750],{"class":258,"line":756},[256,1751,1675],{"class":262},[256,1753,1754,1756,1758],{"class":258,"line":770},[256,1755,1680],{"class":262},[256,1757,1718],{"class":266},[256,1759,1760],{"class":266}," dirname...\n",[256,1762,1763],{"class":258,"line":781},[256,1764,1675],{"class":262},[256,1766,1767,1769,1771],{"class":258,"line":791},[256,1768,1680],{"class":262},[256,1770,1718],{"class":266},[256,1772,1773],{"class":266}," awk...\n",[256,1775,1776],{"class":258,"line":799},[256,1777,1675],{"class":262},[256,1779,1780],{"class":258,"line":829},[256,1781,1659],{"emptyLinePlaceholder":1658},[256,1783,1785,1788,1790],{"class":258,"line":1784},19,[256,1786,1787],{"class":262},"Subsystem",[256,1789,523],{"class":266},[256,1791,1792],{"class":266}," \u002Fusr\u002Flib\u002Fopenssh\u002Fsftp-server\n",[256,1794,1796],{"class":258,"line":1795},20,[256,1797,1659],{"emptyLinePlaceholder":1658},[256,1799,1801],{"class":258,"line":1800},21,[256,1802,1803],{"class":262},"-----------------------------\n",[256,1805,1807,1810,1813,1816],{"class":258,"line":1806},22,[256,1808,1809],{"class":262},"The",[256,1811,1812],{"class":266}," file",[256,1814,1815],{"class":266}," \u002Fbin\u002Fchroot-shell",[256,1817,1818],{"class":266}," exists.\n",[256,1820,1822,1825,1828,1831,1834,1837,1840],{"class":258,"line":1821},23,[256,1823,1824],{"class":262},"Probably",[256,1826,1827],{"class":266}," it",[256,1829,1830],{"class":266}," was",[256,1832,1833],{"class":266}," created",[256,1835,1836],{"class":266}," by",[256,1838,1839],{"class":266}," this",[256,1841,1842],{"class":266}," script.\n",[256,1844,1846],{"class":258,"line":1845},24,[256,1847,1659],{"emptyLinePlaceholder":1658},[256,1849,1851,1854,1857,1860,1862,1865,1868,1871],{"class":258,"line":1850},25,[256,1852,1853],{"class":262},"Are",[256,1855,1856],{"class":266}," you",[256,1858,1859],{"class":266}," sure",[256,1861,1856],{"class":266},[256,1863,1864],{"class":266}," want",[256,1866,1867],{"class":266}," to",[256,1869,1870],{"class":266}," overwrite",[256,1872,1873],{"class":266}," it?\n",[256,1875,1877,1880,1883,1885,1887,1890,1893,1895,1898,1900,1902,1905,1907,1910,1913,1915,1917],{"class":258,"line":1876},26,[256,1878,1879],{"class":649},"(",[256,1881,1882],{"class":262},"you",[256,1884,1864],{"class":266},[256,1886,1867],{"class":266},[256,1888,1889],{"class":266}," say",[256,1891,1892],{"class":266}," yes",[256,1894,1718],{"class":266},[256,1896,1897],{"class":266}," example",[256,1899,1197],{"class":266},[256,1901,1856],{"class":266},[256,1903,1904],{"class":266}," are",[256,1906,1705],{"class":266},[256,1908,1909],{"class":266}," the",[256,1911,1912],{"class":266}," script",[256,1914,1718],{"class":266},[256,1916,1909],{"class":266},[256,1918,1919],{"class":266}," second\n",[256,1921,1923,1926,1929],{"class":258,"line":1922},27,[256,1924,1925],{"class":1051},"time",[256,1927,1928],{"class":328}," when adding more than one account to the jail",[256,1930,1931],{"class":649},")\n",[256,1933,1935,1937,1940,1943,1945,1947],{"class":258,"line":1934},28,[256,1936,1879],{"class":649},[256,1938,1939],{"class":262},"yes\u002Fno",[256,1941,1942],{"class":649},")",[256,1944,923],{"class":262},[256,1946,329],{"class":328},[256,1948,1949],{"class":266},"yes\n",[256,1951,1953],{"class":258,"line":1952},29,[256,1954,1659],{"emptyLinePlaceholder":1658},[256,1956,1958,1961],{"class":258,"line":1957},30,[256,1959,1960],{"class":262},"Modifying",[256,1962,1963],{"class":266}," \u002Fetc\u002Fsudoers\n",[256,1965,1967,1970,1973,1975,1978,1980,1982],{"class":258,"line":1966},31,[256,1968,1969],{"class":262},"Adding",[256,1971,1972],{"class":266}," User",[256,1974,1475],{"class":649},[256,1976,1977],{"class":266},"jeremie",[256,1979,1190],{"class":649},[256,1981,1867],{"class":266},[256,1983,1984],{"class":266}," system\n",[256,1986,1988,1990,1992,1995,1998,2000,2003,2006],{"class":258,"line":1987},32,[256,1989,713],{"class":262},[256,1991,338],{"class":266},[256,1993,1994],{"class":266}," nouveau",[256,1996,1997],{"class":266}," mot",[256,1999,643],{"class":266},[256,2001,2002],{"class":266}," passe",[256,2004,2005],{"class":266}," UNIX",[256,2007,2008],{"class":266}," :\n",[256,2010,2012,2015,2017,2019,2021,2023,2025,2027],{"class":258,"line":2011},33,[256,2013,2014],{"class":262},"Retapez",[256,2016,338],{"class":266},[256,2018,1994],{"class":266},[256,2020,1997],{"class":266},[256,2022,643],{"class":266},[256,2024,2002],{"class":266},[256,2026,2005],{"class":266},[256,2028,2008],{"class":266},[256,2030,2032,2035,2037,2039,2041,2043,2046,2049,2052,2055,2058,2061],{"class":258,"line":2031},34,[256,2033,2034],{"class":262},"passwd :",[256,2036,338],{"class":266},[256,2038,1997],{"class":266},[256,2040,643],{"class":266},[256,2042,2002],{"class":266},[256,2044,2045],{"class":266}," a",[256,2047,2048],{"class":266}," été",[256,2050,2051],{"class":266}," mis",[256,2053,2054],{"class":266}," à",[256,2056,2057],{"class":266}," jour",[256,2059,2060],{"class":266}," avec",[256,2062,2063],{"class":266}," succès\n",[256,2065,2067],{"class":258,"line":2066},35,[256,2068,1659],{"emptyLinePlaceholder":1658},[256,2070,2072,2074,2076,2078,2080],{"class":258,"line":2071},36,[256,2073,1969],{"class":262},[256,2075,1972],{"class":266},[256,2077,1089],{"class":266},[256,2079,1867],{"class":266},[256,2081,2082],{"class":266}," jail\n",[256,2084,2086,2089,2092,2095,2097,2100,2103,2106,2109,2112],{"class":258,"line":2085},37,[256,2087,2088],{"class":262},"Copying",[256,2090,2091],{"class":266}," necessary",[256,2093,2094],{"class":266}," library-files",[256,2096,1867],{"class":266},[256,2098,2099],{"class":266}," jail",[256,2101,2102],{"class":328}," (may ",[256,2104,2105],{"class":266},"take",[256,2107,2108],{"class":266}," some",[256,2110,2111],{"class":266}," time",[256,2113,1931],{"class":328},[256,2115,2117,2119,2122,2125,2128,2130],{"class":258,"line":2116},38,[256,2118,2088],{"class":262},[256,2120,2121],{"class":266}," files",[256,2123,2124],{"class":266}," from",[256,2126,2127],{"class":266}," \u002Fetc\u002Fpam.d\u002F",[256,2129,1867],{"class":266},[256,2131,2082],{"class":266},[256,2133,2135,2137,2140,2142],{"class":258,"line":2134},39,[256,2136,2088],{"class":262},[256,2138,2139],{"class":266}," PAM-Modules",[256,2141,1867],{"class":266},[256,2143,2082],{"class":266},[15,2145,2146],{},"Si vous naviguez dans le dossier prison  :",[247,2148,2150],{"className":249,"code":2149,"language":251,"meta":201,"style":201},"ls -al \u002Fhome\u002Fjail\n",[253,2151,2152],{"__ignoreMap":201},[256,2153,2154,2156,2159],{"class":258,"line":259},[256,2155,945],{"class":262},[256,2157,2158],{"class":266}," -al",[256,2160,2161],{"class":266}," \u002Fhome\u002Fjail\n",[15,2163,2164,2165,2167],{},"Vous vous rendrez compte du travail effectué par le script fuschlberger.",[35,2166],{},"\nEssayez de vous connecter avec votre utilisateur précédemment créé :",[247,2169,2170],{"className":249,"code":913,"language":251,"meta":201,"style":201},[253,2171,2172],{"__ignoreMap":201},[256,2173,2174,2176,2178],{"class":258,"line":259},[256,2175,920],{"class":262},[256,2177,923],{"class":266},[256,2179,630],{"class":266},[15,2181,2182,2183,474],{},"Erreur « ",[26,2184,2185],{},"su: module is unknow",[247,2187,2189],{"className":249,"code":2188,"language":251,"meta":201,"style":201}," su: Module is unknown\n",[253,2190,2191],{"__ignoreMap":201},[256,2192,2193,2196,2199,2201],{"class":258,"line":259},[256,2194,2195],{"class":262}," su:",[256,2197,2198],{"class":266}," Module",[256,2200,1702],{"class":266},[256,2202,2203],{"class":266}," unknown\n",[15,2205,2206,2207,375],{},"La solution que j’ai trouvée est de modifier le fichier ",[26,2208,2209],{},"chroot-shell",[247,2211,2213],{"className":249,"code":2212,"language":251,"meta":201,"style":201},"nano \u002Fbin\u002Fchroot-shell\n",[253,2214,2215],{"__ignoreMap":201},[256,2216,2217,2219],{"class":258,"line":259},[256,2218,539],{"class":262},[256,2220,2221],{"class":266}," \u002Fbin\u002Fchroot-shell\n",[15,2223,2224],{},"Initialement vous trouverez ceci à l’intérieur :",[247,2226,2228],{"className":249,"code":2227,"language":251,"meta":201,"style":201},"#!\u002Fbin\u002Fbash \n\u002Fusr\u002Fbin\u002Fsudo \u002Fusr\u002Fsbin\u002Fchroot \u002Fhome\u002Fjail \u002Fbin\u002Fsu - $USER \"$@\"\n",[253,2229,2230,2236],{"__ignoreMap":201},[256,2231,2232],{"class":258,"line":259},[256,2233,2235],{"class":2234},"sHwdD","#!\u002Fbin\u002Fbash \n",[256,2237,2238,2241,2244,2246,2249,2251,2254,2256,2260],{"class":258,"line":322},[256,2239,2240],{"class":262},"\u002Fusr\u002Fbin\u002Fsudo",[256,2242,2243],{"class":266}," \u002Fusr\u002Fsbin\u002Fchroot",[256,2245,508],{"class":266},[256,2247,2248],{"class":266}," \u002Fbin\u002Fsu",[256,2250,923],{"class":266},[256,2252,2253],{"class":328}," $USER ",[256,2255,1190],{"class":649},[256,2257,2259],{"class":2258},"sHdIc","$@",[256,2261,2262],{"class":649},"\"\n",[15,2264,2265],{},"La modification à effectuer  :",[247,2267,2269],{"className":249,"code":2268,"language":251,"meta":201,"style":201},"#!\u002Fbin\u002Fbash\nsudo \u002Fusr\u002Fsbin\u002Fchroot \u002Fhome\u002Fjail \u002Fbin\u002Fbash\n",[253,2270,2271,2276],{"__ignoreMap":201},[256,2272,2273],{"class":258,"line":259},[256,2274,2275],{"class":2234},"#!\u002Fbin\u002Fbash\n",[256,2277,2278,2281,2283,2285],{"class":258,"line":322},[256,2279,2280],{"class":262},"sudo",[256,2282,2243],{"class":266},[256,2284,508],{"class":266},[256,2286,2287],{"class":266}," \u002Fbin\u002Fbash\n",[15,2289,2290],{},"Ensuite il faut relancer la commande :",[247,2292,2293],{"className":249,"code":913,"language":251,"meta":201,"style":201},[253,2294,2295],{"__ignoreMap":201},[256,2296,2297,2299,2301],{"class":258,"line":259},[256,2298,920],{"class":262},[256,2300,923],{"class":266},[256,2302,630],{"class":266},[15,2304,2305,2306,2309,2310,2312,2313,2316],{},"Vous êtes normalement ",[26,2307,2308],{},"logué"," sans aucune erreur et vous êtes bien dans votre prison.",[35,2311],{},"\nCependant, vous avez une ",[26,2314,2315],{},"liste de commandes restreintes"," , pour en rajouter : éditez le script !",[247,2318,2320],{"className":249,"code":2319,"language":251,"meta":201,"style":201},"nano \u002Fusr\u002Flocal\u002Fsbin make_chroot_jail.sh\n",[253,2321,2322],{"__ignoreMap":201},[256,2323,2324,2326,2329],{"class":258,"line":259},[256,2325,539],{"class":262},[256,2327,2328],{"class":266}," \u002Fusr\u002Flocal\u002Fsbin",[256,2330,1055],{"class":266},[15,2332,2333,2334,2337,2338,2341],{},"Recherchez la ligne « ",[26,2335,2336],{},"APPS"," » avec « ",[26,2339,2340],{},"ctrl + w","« et rajouter le chemin des commandes souhaitées.",[247,2343,2345],{"className":249,"code":2344,"language":251,"meta":201,"style":201},"elif [ \"$DISTRO\" = DEBIAN ]; then\n  APPS=\"\u002Fbin\u002Fbash \u002Fbin\u002Fcrontab \u002Fbin\u002Fvim \u002Fbin\u002Fmysql \u002Fbin\u002Fhg \u002Fbin\u002Fhg-ssh \u002Fusr\u002Fbin\u002Fclear \u002Fusr\u002Fbin\u002Fncurses5-config \u002Fbin\u002Fnano \u002Fbin\u002Fcp \u002Fusr\u002Fbin\u002F \u002Fbin\u002Fls \u002Fbin\u002Fmkdir \u002Fbin\u002Fmv \u002Fbin\u002Frm \u002Fbin\u002Frmdir \u002Fbin\u002Fsh \u002Fbin\u002Fping  \u002Fbin\u002Fsu \u002Fusr\u002Fbin\u002Fgroups \u002Fusr\u002Fbin\u002Fid \u002Fusr\u002Fbin\u002Frsync \u002Fusr\u002Fbin\u002Fssh \u002Fusr\u002Fbin\u002Fscp \u002Fsbin\u002Funix_chkpwd\"\n",[253,2346,2347,2367],{"__ignoreMap":201},[256,2348,2349,2351,2353,2355,2357,2359,2361,2363,2365],{"class":258,"line":259},[256,2350,1470],{"class":1196},[256,2352,1200],{"class":649},[256,2354,1475],{"class":649},[256,2356,1478],{"class":328},[256,2358,1190],{"class":649},[256,2360,1483],{"class":649},[256,2362,1486],{"class":328},[256,2364,1489],{"class":649},[256,2366,1492],{"class":1196},[256,2368,2369,2372,2374,2376,2379],{"class":258,"line":322},[256,2370,2371],{"class":328},"  APPS",[256,2373,325],{"class":649},[256,2375,1190],{"class":649},[256,2377,2378],{"class":266},"\u002Fbin\u002Fbash \u002Fbin\u002Fcrontab \u002Fbin\u002Fvim \u002Fbin\u002Fmysql \u002Fbin\u002Fhg \u002Fbin\u002Fhg-ssh \u002Fusr\u002Fbin\u002Fclear \u002Fusr\u002Fbin\u002Fncurses5-config \u002Fbin\u002Fnano \u002Fbin\u002Fcp \u002Fusr\u002Fbin\u002F \u002Fbin\u002Fls \u002Fbin\u002Fmkdir \u002Fbin\u002Fmv \u002Fbin\u002Frm \u002Fbin\u002Frmdir \u002Fbin\u002Fsh \u002Fbin\u002Fping  \u002Fbin\u002Fsu \u002Fusr\u002Fbin\u002Fgroups \u002Fusr\u002Fbin\u002Fid \u002Fusr\u002Fbin\u002Frsync \u002Fusr\u002Fbin\u002Fssh \u002Fusr\u002Fbin\u002Fscp \u002Fsbin\u002Funix_chkpwd",[256,2380,2262],{"class":649},[15,2382,2383],{},"Ensuite, il faut mettre à jour votre prison avec le script :",[247,2385,2387],{"className":249,"code":2386,"language":251,"meta":201,"style":201},"make_chroot_jail.sh update\n",[253,2388,2389],{"__ignoreMap":201},[256,2390,2391,2393],{"class":258,"line":259},[256,2392,1068],{"class":262},[256,2394,2395],{"class":266}," update\n",[15,2397,2398,2399,375],{},"Aussi, si vous souhaitez résoudre des noms de domaine il vous faudra ajouter la ",[26,2400,2401],{},"librairie DNS",[247,2403,2405],{"className":249,"code":2404,"language":251,"meta":201,"style":201},"cp \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_dns.so.2 \u002Fhome\u002Fjail\u002Flib\n",[253,2406,2407],{"__ignoreMap":201},[256,2408,2409,2412,2415],{"class":258,"line":259},[256,2410,2411],{"class":262},"cp",[256,2413,2414],{"class":266}," \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_dns.so.2",[256,2416,2417],{"class":266}," \u002Fhome\u002Fjail\u002Flib\n",[15,2419,2420,2421,33],{},"Ce script est un peu vieillissant mais constitue une bonne base pour commencer le ",[26,2422,2423],{},"jail\u002Fchroot",[10,2425,2427],{"id":2426},"conclusion","Conclusion",[15,2429,2430,2431,2433],{},"J'ai comparé ici deux méthodes pour emprisonner un utilisateur SSH sous Linux : le script Jailkit, plus récent et maintenu, et le script fuschlberger, plus ancien mais toujours fonctionnel moyennant quelques adaptations pour la version 64 bits. Ces techniques de chroot\u002Fjail permettent de fournir un accès restreint à un serveur de production sans exposer l'intégralité de son arborescence, ce qui renforce la sécurité et la confidentialité lors de collaborations externes. Un point de vigilance : la liste des commandes disponibles dans la prison doit être ajustée avec parcimonie pour ne pas recréer un environnement trop ouvert.\nPersonnellement je me suis arrêté là et je n’ai pas recherché les autres options possibles.",[35,2432],{},"\nVous savez maintenant utiliser ces deux scripts ! Partagez vos retours dans la section commentaire.",[2435,2436,2437],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}",{"title":201,"searchDepth":322,"depth":322,"links":2439},[2440,2441,2442,2443,2444,2447],{"id":12,"depth":322,"text":13},{"id":20,"depth":322,"text":21},{"id":93,"depth":322,"text":94},{"id":232,"depth":322,"text":233},{"id":980,"depth":322,"text":981,"children":2445},[2446],{"id":1117,"depth":656,"text":1118},{"id":2426,"depth":322,"text":2427},null,"\u002Fimages\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux\u002F5e5571284a.png","2014-02-23","Comprendre la technique du chroot\u002Fjail sous linux. Des accès restreints pour vos utilisateurs en SSH. Utilisez le Jailkit ou le script fuschlberger!","md",{},"\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux",{"title":5,"description":2451},"emprisonner-utilisateur-ssh-sous-linux","blog\u002Femprisonner-utilisateur-ssh-sous-linux","cYw3_LmUvEVhz5MCf6bPT4eVBLraEDgvpjTT7S2gUgo",[2460,2468,2476,2482,2489,2496,2502,2507],{"title":2461,"path":2462,"stem":2463,"date":2464,"cover":2465,"categories":2466,"children":-1},"Configuration d’une passerelle SRX100 sous J-Web","\u002Fblog\u002Fconfiguration-une-passerelle-srx100-sous-web","blog\u002Fconfiguration-une-passerelle-srx100-sous-web","2014-07-10","\u002Fimages\u002Fblog\u002Fconfiguration-une-passerelle-srx100-sous-web\u002F1b4814003c.jpg",[2467],"Réseau",{"title":2469,"path":2470,"stem":2471,"date":2472,"cover":2473,"categories":2474,"children":-1},"Hack In Paris et Nuit du Hack du 26 au 29 Juin 2014","\u002Fblog\u002Fhack-paris-nuit-hack-juin-2014","blog\u002Fhack-paris-nuit-hack-juin-2014","2014-04-11","\u002Fimages\u002Fblog\u002Fhack-paris-nuit-hack-juin-2014\u002Fd1c6cbea4e.jpg",[2475],"Évènement",{"title":2477,"path":2478,"stem":2479,"date":2480,"cover":2481,"categories":2448,"children":-1},"Configurer l’interface web de ruTorrent avec Apache2","\u002Fblog\u002Fconfigurer-interface-web-rutorrent-avec-apache2","blog\u002Fconfigurer-interface-web-rutorrent-avec-apache2","2014-03-31","\u002Fimages\u002Fblog\u002Fconfigurer-interface-web-rutorrent-avec-apache2\u002F672919258b.png",{"title":2483,"path":2484,"stem":2485,"date":2486,"cover":2487,"categories":2488,"children":-1},"La destruction de la neutralité du Net est en marche : Indignez-vous!","\u002Fblog\u002Fdestruction-neutralite-net-est-marche-indignez-vous","blog\u002Fdestruction-neutralite-net-est-marche-indignez-vous","2014-03-23","\u002Fimages\u002Fblog\u002Fdestruction-neutralite-net-est-marche-indignez-vous\u002Fddb702d91a.jpg",[2475],{"title":2490,"path":2491,"stem":2492,"date":2493,"cover":2494,"categories":2495,"children":-1},"Découvrez la magie : Adobe Creative Cloud !","\u002Fblog\u002Fdecouvrez-magie-adobe-creative-cloud","blog\u002Fdecouvrez-magie-adobe-creative-cloud","2014-02-06","\u002Fimages\u002Fblog\u002Fdecouvrez-magie-adobe-creative-cloud\u002Fc5befd8385.jpg",[2475],{"title":2497,"path":2498,"stem":2499,"date":2500,"cover":2501,"categories":2448,"children":-1},"Le Fitbit Force, précurseur des bracelets connectés","\u002Fblog\u002Ffitbit-force-precurseur-des-bracelets-connectes","blog\u002Ffitbit-force-precurseur-des-bracelets-connectes","2014-01-29","\u002Fimages\u002Fblog\u002Ffitbit-force-precurseur-des-bracelets-connectes\u002F591236ebce.jpg",{"title":2503,"path":2504,"stem":2505,"date":2500,"cover":2506,"categories":2448,"children":-1},"Installation de Plex Media Server sur Debian 8","\u002Fblog\u002Finstallation-plex-media-server-sur-debian","blog\u002Finstallation-plex-media-server-sur-debian","\u002Fimages\u002Fblog\u002Finstallation-plex-media-server-sur-debian\u002Fea86a7e30d.png",{"title":2508,"path":2509,"stem":2510,"date":2511,"cover":2512,"categories":2448,"children":-1},"Installation de Splunk sur Debian 7","\u002Fblog\u002Finstallation-splunk-sur-debian","blog\u002Finstallation-splunk-sur-debian","2014-01-14","\u002Fimages\u002Fblog\u002Finstallation-splunk-sur-debian\u002Ff8405ad901.jpg",[],1786644879591]