[{"data":1,"prerenderedAt":2410},["ShallowReactive",2],{"blog-\u002Fen\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux":3,"blog-\u002Fen\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux-surround":2355,"blog-\u002Fen\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux-certifications":2409},{"id":4,"title":5,"body":6,"categories":2344,"cover":2345,"cover_contain":1596,"credly_badge_id":2344,"date":2346,"description":2347,"extension":2348,"meta":2349,"navigation":1596,"path":2350,"related_certifications":2344,"seo":2351,"slug":2352,"stem":2353,"__hash__":2354},"blog\u002Fen\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux.md","Jailing an SSH User on Linux",{"type":7,"value":8,"toc":2334},"minimark",[9,14,18,22,77,90,94,97,153,190,197,222,226,234,237,259,262,278,281,295,298,340,343,355,365,381,388,436,442,455,465,480,483,517,520,533,543,561,567,579,582,601,608,799,802,821,829,841,847,856,865,880,885,921,927,931,942,945,958,963,975,981,998,1001,1013,1020,1044,1055,1060,1069,1080,1083,1252,1259,1397,1400,1492,1495,1561,1564,1576,1579,2040,2043,2058,2064,2076,2082,2100,2107,2119,2122,2159,2162,2184,2187,2199,2213,2227,2238,2277,2280,2292,2298,2314,2320,2324,2330],[10,11,13],"h2",{"id":12},"real-world-use-case","Real-world use case",[15,16,17],"p",{},"You need to restrict an SSH user to a specific scope: here's how to set up a chroot\u002Fjail on Linux.",[10,19,21],{"id":20},"jailing-a-user","Jailing a user",[15,23,24,28,29,32,33,36,37,40,41,44,45,48,49,52,53,55,56,48,59,62,63,66,67,70,71,73,74,76],{},[25,26,27],"strong",{},"Shared projects"," can sometimes lead to giving ",[25,30,31],{},"access to a production server",".",[34,35],"br",{},"\nIt's difficult to give ",[25,38,39],{},"full access"," to the ",[25,42,43],{},"system"," to an external company (",[25,46,47],{},"confidentiality","\u002F",[25,50,51],{},"security",").",[34,54],{},"\nTo address this issue, there's ",[25,57,58],{},"chroot",[25,60,61],{},"jail",", or ",[25,64,65],{},"jailing"," a ",[25,68,69],{},"user"," inside a folder.",[34,72],{},"\nThe complete view of the server's directory tree will no longer be available to this user.",[34,75],{},"\nJailing them provides:",[78,79,80,84,87],"ul",{},[81,82,83],"li",{},"Increased flexibility.",[81,85,86],{},"Additional security.",[81,88,89],{},"Easier access provisioning.",[10,91,93],{"id":92},"creating-a-closed-environment","Creating a closed environment",[15,95,96],{},"Understanding the general steps in creating a chroot\u002Fjail is important:",[98,99,100,108,114,120,127,134,141,147],"ol",{},[81,101,102,103,105,106,32],{},"Creating a ",[25,104,69],{}," on the ",[25,107,43],{},[81,109,110,111,32],{},"Creating the ",[25,112,113],{},"jail directory's structure",[81,115,116,117,32],{},"Adding a ",[25,118,119],{},"command interpreter",[81,121,122,123,126],{},"Mounting ",[25,124,125],{},"devices"," (optional).",[81,128,129,130,133],{},"Modifying certain \"",[25,131,132],{},"\u002Fetc\u002F","\" files.",[81,135,136,137,140],{},"Creating a so-called ",[25,138,139],{},"wrapper"," function.",[81,142,143,144,32],{},"Adding file ",[25,145,146],{},"permissions",[81,148,149,150,32],{},"Adding extra ",[25,151,152],{},"commands",[15,154,155,156,159,160,32,169,171,172,32,175,177,178,181,182,185,186,189],{},"For more information on step-by-step creation of a ",[25,157,158],{},"\"chroot\u002Fjail\""," environment, see ",[161,162,166],"a",{"href":163,"rel":164},"http:\u002F\u002Flea-linux.org\u002Fdocumentations\u002FTrucs:Chrooter_un_utilisateur_%28ssh,_terminal,_console,_etc...%29",[165],"nofollow",[25,167,168],{},"léa-linux",[34,170],{},"\nThis method is fairly long, so we'll instead use existing ",[25,173,174],{},"scripts",[34,176],{},"\nThe scripts we'll use are ",[25,179,180],{},"Jailkit"," and the ",[25,183,184],{},"fuschlberger script"," on ",[25,187,188],{},"Debian 7"," x64.",[15,191,192],{},[193,194],"img",{"alt":195,"src":196},"","\u002Fimages\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux\u002F1bd7f1453c.png",[15,198,199,200,32,203,205,206,213,214,221],{},"The first is a turnkey script that's still actively developed and more advanced, while the second is aging but works just as well, though with more difficulties on the ",[25,201,202],{},"64-bit version",[34,204],{},"\nMore information on the official website of ",[161,207,210],{"href":208,"rel":209},"http:\u002F\u002Folivier.sessink.nl\u002Fjailkit\u002F",[165],[25,211,212],{},"jailkit"," as well as the ",[161,215,218],{"href":216,"rel":217},"http:\u002F\u002Fwww.fuschlberger.net\u002Fprograms\u002Fssh-scp-sftp-chroot-jail\u002F",[165],[25,219,220],{},"fuschlberger"," website.",[10,223,225],{"id":224},"the-jailkit-script","The Jailkit script",[15,227,228,230,231,233],{},[25,229,180],{}," is a maintained script that lets you automate building a jail.",[34,232],{},"\nWe can add one or more users to it in order to restrict them.",[15,235,236],{},"Download the script with \"wget\":",[238,239,243],"pre",{"className":240,"code":241,"language":242,"meta":195,"style":195},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","wget http:\u002F\u002Folivier.sessink.nl\u002Fjailkit\u002Fjailkit-2.17.tar.gz\n","bash",[244,245,246],"code",{"__ignoreMap":195},[247,248,251,255],"span",{"class":249,"line":250},"line",1,[247,252,254],{"class":253},"sBMFI","wget",[247,256,258],{"class":257},"sfazB"," http:\u002F\u002Folivier.sessink.nl\u002Fjailkit\u002Fjailkit-2.17.tar.gz\n",[15,260,261],{},"Extract the file:",[238,263,265],{"className":240,"code":264,"language":242,"meta":195,"style":195},"tar xvzf jailkit-2.17.tar.gz\n",[244,266,267],{"__ignoreMap":195},[247,268,269,272,275],{"class":249,"line":250},[247,270,271],{"class":253},"tar",[247,273,274],{"class":257}," xvzf",[247,276,277],{"class":257}," jailkit-2.17.tar.gz\n",[15,279,280],{},"Head to the folder:",[238,282,284],{"className":240,"code":283,"language":242,"meta":195,"style":195},"cd jailkit-2.17\n",[244,285,286],{"__ignoreMap":195},[247,287,288,292],{"class":249,"line":250},[247,289,291],{"class":290},"s2Zo4","cd",[247,293,294],{"class":257}," jailkit-2.17\n",[15,296,297],{},"Run the following command:",[238,299,301],{"className":240,"code":300,"language":242,"meta":195,"style":195},".\u002Fdebian\u002Frules binary\n=> make[1]: leaving directory \"\u002Froot\u002Fjailkit-2.17\"\n",[244,302,303,311],{"__ignoreMap":195},[247,304,305,308],{"class":249,"line":250},[247,306,307],{"class":253},".\u002Fdebian\u002Frules",[247,309,310],{"class":257}," binary\n",[247,312,314,317,321,324,327,330,334,337],{"class":249,"line":313},2,[247,315,316],{"class":257},"=",[247,318,320],{"class":319},"sTEyZ","> ",[247,322,323],{"class":257},"make[1]:",[247,325,326],{"class":257}," leaving",[247,328,329],{"class":257}," directory",[247,331,333],{"class":332},"sMK4o"," \"",[247,335,336],{"class":257},"\u002Froot\u002Fjailkit-2.17",[247,338,339],{"class":332},"\"\n",[15,341,342],{},"Exit the current directory:",[238,344,346],{"className":240,"code":345,"language":242,"meta":195,"style":195},"cd ..\n",[244,347,348],{"__ignoreMap":195},[247,349,350,352],{"class":249,"line":250},[247,351,291],{"class":290},[247,353,354],{"class":257}," ..\n",[15,356,357,358,361,362,364],{},"Start ",[25,359,360],{},"installing"," ",[25,363,180],{},":",[238,366,368],{"className":240,"code":367,"language":242,"meta":195,"style":195},"dpkg -i jailkit_2.17-1_amd64.deb\n",[244,369,370],{"__ignoreMap":195},[247,371,372,375,378],{"class":249,"line":250},[247,373,374],{"class":253},"dpkg",[247,376,377],{"class":257}," -i",[247,379,380],{"class":257}," jailkit_2.17-1_amd64.deb\n",[15,382,383,384,387],{},"Notice that new commands are now available: try running: \"",[25,385,386],{},"jk_","\"",[238,389,391],{"className":240,"code":390,"language":242,"meta":195,"style":195},"jk_addjailuser   jk_chrootlaunch  jk_cp            jk_jailuser      jk_lsh           jk_uchroot       \njk_check         jk_chrootsh      jk_init          jk_list          jk_socketd       jk_update\n",[244,392,393,416],{"__ignoreMap":195},[247,394,395,398,401,404,407,410,413],{"class":249,"line":250},[247,396,397],{"class":253},"jk_addjailuser",[247,399,400],{"class":257},"   jk_chrootlaunch",[247,402,403],{"class":257},"  jk_cp",[247,405,406],{"class":257},"            jk_jailuser",[247,408,409],{"class":257},"      jk_lsh",[247,411,412],{"class":257},"           jk_uchroot",[247,414,415],{"class":319},"       \n",[247,417,418,421,424,427,430,433],{"class":249,"line":313},[247,419,420],{"class":253},"jk_check",[247,422,423],{"class":257},"         jk_chrootsh",[247,425,426],{"class":257},"      jk_init",[247,428,429],{"class":257},"          jk_list",[247,431,432],{"class":257},"          jk_socketd",[247,434,435],{"class":257},"       jk_update\n",[15,437,438,439,364],{},"Create the ",[25,440,441],{},"jail directory",[238,443,445],{"className":240,"code":444,"language":242,"meta":195,"style":195},"mkdir \u002Fhome\u002Fjail\u002F\n",[244,446,447],{"__ignoreMap":195},[247,448,449,452],{"class":249,"line":250},[247,450,451],{"class":253},"mkdir",[247,453,454],{"class":257}," \u002Fhome\u002Fjail\u002F\n",[15,456,457,458,460,461,464],{},"We need to give all ",[25,459,146],{}," to \"",[25,462,463],{},"root","\":",[238,466,468],{"className":240,"code":467,"language":242,"meta":195,"style":195},"chown root:root \u002Fhome\u002Fjail\u002F\n",[244,469,470],{"__ignoreMap":195},[247,471,472,475,478],{"class":249,"line":250},[247,473,474],{"class":253},"chown",[247,476,477],{"class":257}," root:root",[247,479,454],{"class":257},[15,481,482],{},"Add programs to the jail:",[238,484,486],{"className":240,"code":485,"language":242,"meta":195,"style":195},"jk_init -v \u002Fhome\u002Fjail netutils basicshell jk_lsh ssh sftp editors\n",[244,487,488],{"__ignoreMap":195},[247,489,490,493,496,499,502,505,508,511,514],{"class":249,"line":250},[247,491,492],{"class":253},"jk_init",[247,494,495],{"class":257}," -v",[247,497,498],{"class":257}," \u002Fhome\u002Fjail",[247,500,501],{"class":257}," netutils",[247,503,504],{"class":257}," basicshell",[247,506,507],{"class":257}," jk_lsh",[247,509,510],{"class":257}," ssh",[247,512,513],{"class":257}," sftp",[247,515,516],{"class":257}," editors\n",[15,518,519],{},"To add other programs, simply edit the following configuration file:",[238,521,523],{"className":240,"code":522,"language":242,"meta":195,"style":195},"nano \u002Fetc\u002Fjailkit\u002Fjk_init.ini\n",[244,524,525],{"__ignoreMap":195},[247,526,527,530],{"class":249,"line":250},[247,528,529],{"class":253},"nano",[247,531,532],{"class":257}," \u002Fetc\u002Fjailkit\u002Fjk_init.ini\n",[15,534,535,536,539,540,464],{},"Copying libraries is done with the \"",[25,537,538],{},"jk_cp","\" command, e.g. with \"",[25,541,542],{},"mysql",[238,544,546],{"className":240,"code":545,"language":242,"meta":195,"style":195},"jk_cp -j \u002Fhome\u002Fjail\u002F \u002Fusr\u002Fbin\u002Fmysql\n",[244,547,548],{"__ignoreMap":195},[247,549,550,552,555,558],{"class":249,"line":250},[247,551,538],{"class":253},[247,553,554],{"class":257}," -j",[247,556,557],{"class":257}," \u002Fhome\u002Fjail\u002F",[247,559,560],{"class":257}," \u002Fusr\u002Fbin\u002Fmysql\n",[15,562,563,564,364],{},"For information, here's how to display ",[25,565,566],{},"a program's libraries",[238,568,570],{"className":240,"code":569,"language":242,"meta":195,"style":195},"ldd \u002Fusr\u002Fbin\u002Fmysql\n",[244,571,572],{"__ignoreMap":195},[247,573,574,577],{"class":249,"line":250},[247,575,576],{"class":253},"ldd",[247,578,560],{"class":257},[15,580,581],{},"If you want to use mysql inside your jail:",[238,583,585],{"className":240,"code":584,"language":242,"meta":195,"style":195},"mount --bind \u002Fvar\u002Frun\u002Fmysqld\u002F \u002Fyour\u002Fjail\u002Fvar\u002Frun\u002Fmysqld\u002F\n",[244,586,587],{"__ignoreMap":195},[247,588,589,592,595,598],{"class":249,"line":250},[247,590,591],{"class":253},"mount",[247,593,594],{"class":257}," --bind",[247,596,597],{"class":257}," \u002Fvar\u002Frun\u002Fmysqld\u002F",[247,599,600],{"class":257}," \u002Fyour\u002Fjail\u002Fvar\u002Frun\u002Fmysqld\u002F\n",[15,602,603,604,607],{},"Create the user who will be \"",[25,605,606],{},"chrooted","\" in their jail:",[238,609,611],{"className":240,"code":610,"language":242,"meta":195,"style":195},"adduser jeremie\n=>Adding user `jeremie' ...\nAdding new group `jeremie' (1001) ...\nAdding new user `jeremie' (1001) with group `jeremie' ...\nCreating home directory `\u002Fhome\u002Fjeremie'...\nCopying files from `\u002Fetc\u002Fskel'...\nEnter new UNIX password:\nRetype new UNIX password:\npasswd: password updated successfully\nChanging the user information for jeremie\nEnter the new value, or press Enter for the default\n        Full Name []: Jérémie Kassianoff\n        Room Number []:\n        Work Phone []:\n        Home Phone []:\n        Other []:\nchfn : name contains non-ASCII characters: Jérémie Kassianoff\nIs the information correct? [Y\u002Fn]Y\n",[244,612,613,621,640,649,669,685,694,703,711,720,729,737,746,755,764,772,781,790],{"__ignoreMap":195},[247,614,615,618],{"class":249,"line":250},[247,616,617],{"class":253},"adduser",[247,619,620],{"class":257}," jeremie\n",[247,622,623,625,628,631,634,637],{"class":249,"line":313},[247,624,316],{"class":257},[247,626,627],{"class":319},">",[247,629,630],{"class":257},"Adding",[247,632,633],{"class":257}," user",[247,635,636],{"class":332}," `",[247,638,639],{"class":253},"jeremie' ...\n",[247,641,643,646],{"class":249,"line":642},3,[247,644,645],{"class":253},"Adding new group `jeremie'",[247,647,648],{"class":257}," (1001) ...\n",[247,650,652,654,657,660,663,666],{"class":249,"line":651},4,[247,653,630],{"class":253},[247,655,656],{"class":257}," new user ",[247,658,659],{"class":332},"`",[247,661,662],{"class":253},"jeremie",[247,664,665],{"class":253},"' (1001) with group `jeremie'",[247,667,668],{"class":257}," ...\n",[247,670,672,675,678,680,682],{"class":249,"line":671},5,[247,673,674],{"class":253},"Creating",[247,676,677],{"class":257}," home",[247,679,329],{"class":257},[247,681,636],{"class":332},[247,683,684],{"class":253},"\u002Fhome\u002Fjeremie'...\n",[247,686,688,691],{"class":249,"line":687},6,[247,689,690],{"class":253},"Copying files from `\u002Fetc\u002Fskel'",[247,692,693],{"class":290},"...\n",[247,695,697,700],{"class":249,"line":696},7,[247,698,699],{"class":253},"Enter",[247,701,702],{"class":257}," new UNIX password:\n",[247,704,706,709],{"class":249,"line":705},8,[247,707,708],{"class":253},"Retype",[247,710,702],{"class":257},[247,712,714,717],{"class":249,"line":713},9,[247,715,716],{"class":253},"passwd:",[247,718,719],{"class":257}," password updated successfully\n",[247,721,723,726],{"class":249,"line":722},10,[247,724,725],{"class":253},"Changing",[247,727,728],{"class":257}," the user information for jeremie\n",[247,730,732,734],{"class":249,"line":731},11,[247,733,699],{"class":253},[247,735,736],{"class":257}," the new value, or press Enter for the default\n",[247,738,740,743],{"class":249,"line":739},12,[247,741,742],{"class":253},"        Full",[247,744,745],{"class":257}," Name []: Jérémie Kassianoff\n",[247,747,749,752],{"class":249,"line":748},13,[247,750,751],{"class":253},"        Room",[247,753,754],{"class":257}," Number []:\n",[247,756,758,761],{"class":249,"line":757},14,[247,759,760],{"class":253},"        Work",[247,762,763],{"class":257}," Phone []:\n",[247,765,767,770],{"class":249,"line":766},15,[247,768,769],{"class":253},"        Home",[247,771,763],{"class":257},[247,773,775,778],{"class":249,"line":774},16,[247,776,777],{"class":253},"        Other",[247,779,780],{"class":257}," []:\n",[247,782,784,787],{"class":249,"line":783},17,[247,785,786],{"class":253},"chfn",[247,788,789],{"class":257}," : name contains non-ASCII characters: Jérémie Kassianoff\n",[247,791,793,796],{"class":249,"line":792},18,[247,794,795],{"class":253},"Is",[247,797,798],{"class":257}," the information correct? [Y\u002Fn]Y\n",[15,800,801],{},"We add the user to the jail with the following command:",[238,803,805],{"className":240,"code":804,"language":242,"meta":195,"style":195},"jk_jailuser -m -j \u002Fhome\u002Fjail\u002F jeremie\n",[244,806,807],{"__ignoreMap":195},[247,808,809,812,815,817,819],{"class":249,"line":250},[247,810,811],{"class":253},"jk_jailuser",[247,813,814],{"class":257}," -m",[247,816,554],{"class":257},[247,818,557],{"class":257},[247,820,620],{"class":257},[15,822,823,824,826,827,364],{},"Edit the file of existing users on the \"",[25,825,61],{},"\" ",[25,828,43],{},[238,830,832],{"className":240,"code":831,"language":242,"meta":195,"style":195},"nano \u002Fhome\u002Fjail\u002Fetc\u002Fpasswd\n",[244,833,834],{"__ignoreMap":195},[247,835,836,838],{"class":249,"line":250},[247,837,529],{"class":253},[247,839,840],{"class":257}," \u002Fhome\u002Fjail\u002Fetc\u002Fpasswd\n",[15,842,843,844,464],{},"Find your user and change your \"",[25,845,846],{},"shell",[238,848,850],{"className":240,"code":849,"language":242,"meta":195,"style":195},"jeremie:x:1001:1001:,,,:\u002Fhome\u002Fjeremie:\u002Fbin\u002Fbash\n",[244,851,852],{"__ignoreMap":195},[247,853,854],{"class":249,"line":250},[247,855,849],{"class":253},[15,857,858,859,862,863,364],{},"You can now ",[25,860,861],{},"log in"," as your ",[25,864,69],{},[238,866,868],{"className":240,"code":867,"language":242,"meta":195,"style":195},"su - jeremie\n",[244,869,870],{"__ignoreMap":195},[247,871,872,875,878],{"class":249,"line":250},[247,873,874],{"class":253},"su",[247,876,877],{"class":257}," -",[247,879,620],{"class":257},[15,881,882,883,364],{},"Show the jail's ",[25,884,463],{},[238,886,888],{"className":240,"code":887,"language":242,"meta":195,"style":195},"ls \u002F\nbin  dev  etc  home  lib  lib64  usr\n",[244,889,890,898],{"__ignoreMap":195},[247,891,892,895],{"class":249,"line":250},[247,893,894],{"class":253},"ls",[247,896,897],{"class":257}," \u002F\n",[247,899,900,903,906,909,912,915,918],{"class":249,"line":313},[247,901,902],{"class":253},"bin",[247,904,905],{"class":257},"  dev",[247,907,908],{"class":257},"  etc",[247,910,911],{"class":257},"  home",[247,913,914],{"class":257},"  lib",[247,916,917],{"class":257},"  lib64",[247,919,920],{"class":257},"  usr\n",[15,922,923,924,926],{},"The ",[25,925,212],{}," introduction is complete.",[10,928,930],{"id":929},"the-fuschlberger-script","The fuschlberger script",[15,932,923,933,935,936,938,939,941],{},[25,934,184],{}," is fairly old (2008) but it still works very well.",[34,937],{},"\nWe'll get it running on ",[25,940,188],{}," 64-bit.",[15,943,944],{},"Before anything else, make sure you have the following packages installed:",[238,946,948],{"className":240,"code":947,"language":242,"meta":195,"style":195},"debianutils coreutils\n",[244,949,950],{"__ignoreMap":195},[247,951,952,955],{"class":249,"line":250},[247,953,954],{"class":253},"debianutils",[247,956,957],{"class":257}," coreutils\n",[15,959,960,961,464],{},"Download the script with \"",[25,962,254],{},[238,964,966],{"className":240,"code":965,"language":242,"meta":195,"style":195},"wget http:\u002F\u002Fwww.fuschlberger.net\u002Fprograms\u002Fssh-scp-sftp-chroot-jail\u002Fmake_chroot_jail.sh\n",[244,967,968],{"__ignoreMap":195},[247,969,970,972],{"class":249,"line":250},[247,971,254],{"class":253},[247,973,974],{"class":257}," http:\u002F\u002Fwww.fuschlberger.net\u002Fprograms\u002Fssh-scp-sftp-chroot-jail\u002Fmake_chroot_jail.sh\n",[15,976,977,978,364],{},"Make the ",[25,979,980],{},"script executable",[238,982,984],{"className":240,"code":983,"language":242,"meta":195,"style":195},"chmod 770 make_chroot_jail.sh\n",[244,985,986],{"__ignoreMap":195},[247,987,988,991,995],{"class":249,"line":250},[247,989,990],{"class":253},"chmod",[247,992,994],{"class":993},"sbssI"," 770",[247,996,997],{"class":257}," make_chroot_jail.sh\n",[15,999,1000],{},"Run the script (simplified version):",[238,1002,1004],{"className":240,"code":1003,"language":242,"meta":195,"style":195},"make_chroot_jail.sh jeremie\n",[244,1005,1006],{"__ignoreMap":195},[247,1007,1008,1011],{"class":249,"line":250},[247,1009,1010],{"class":253},"make_chroot_jail.sh",[247,1012,620],{"class":257},[15,1014,1015,1016,1019],{},"By default the jail will be located at \"",[25,1017,1018],{},"\u002Fhome\u002Fjail","\", if you want to change the directory:",[238,1021,1023],{"className":240,"code":1022,"language":242,"meta":195,"style":195},"make_chroot_jail.sh jeremie [\u002Fpath\u002Fshell] [\u002Fpath\u002Fjail]\n",[244,1024,1025],{"__ignoreMap":195},[247,1026,1027,1029,1032,1035,1038,1041],{"class":249,"line":250},[247,1028,1010],{"class":253},[247,1030,1031],{"class":257}," jeremie",[247,1033,1034],{"class":319}," [\u002Fpath\u002Fshell] ",[247,1036,1037],{"class":332},"[",[247,1039,1040],{"class":319},"\u002Fpath\u002Fjail",[247,1042,1043],{"class":332},"]\n",[15,1045,1046,1047,105,1050,32,1052,1054],{},"If you run the script, you'll most certainly get an ",[25,1048,1049],{},"error",[25,1051,202],{},[34,1053],{},"\nNow we're going to start changing certain values in the script.",[1056,1057,1059],"h3",{"id":1058},"errors-on-debian-7-x64","Errors on Debian 7 X64",[15,1061,1062,1063,1065,1066,364],{},"The first time you run the script (x64) you probably saw errors appear.",[34,1064],{},"\nTo fix the first error (line 406 & 407), you need to ",[25,1067,1068],{},"edit the fuschlberger script",[238,1070,1072],{"className":240,"code":1071,"language":242,"meta":195,"style":195},"nano make_chroot_jail.sh\n",[244,1073,1074],{"__ignoreMap":195},[247,1075,1076,1078],{"class":249,"line":250},[247,1077,529],{"class":253},[247,1079,997],{"class":257},[15,1081,1082],{},"Then find the following two lines:",[238,1084,1086],{"className":240,"code":1085,"language":242,"meta":195,"style":195},"TMPFILE1=`mktemp` &> \u002Fdev\u002Fnull ||  TMPFILE1=\"${HOME}\u002Fldlist\"; if [ -x ${TMPFILE1} ]; then mv ${TMPFILE1} ${TMPFILE1}.bak;fi\nTMPFILE2=`mktemp` &> \u002Fdev\u002Fnull ||  TMPFILE2=\"${HOME}\u002Fldlist2\"; if [ -x ${TMPFILE2} ]; then mv ${TMPFILE2} ${TMPFILE2}.bak;fi\n",[244,1087,1088,1179],{"__ignoreMap":195},[247,1089,1090,1093,1095,1097,1100,1102,1105,1108,1111,1114,1116,1119,1122,1125,1128,1130,1133,1137,1140,1143,1146,1148,1150,1153,1156,1159,1161,1163,1165,1167,1169,1171,1174,1176],{"class":249,"line":250},[247,1091,1092],{"class":319},"TMPFILE1",[247,1094,316],{"class":332},[247,1096,659],{"class":332},[247,1098,1099],{"class":253},"mktemp",[247,1101,659],{"class":332},[247,1103,1104],{"class":332}," &>",[247,1106,1107],{"class":319}," \u002Fdev\u002Fnull ",[247,1109,1110],{"class":332},"||",[247,1112,1113],{"class":319},"  TMPFILE1",[247,1115,316],{"class":332},[247,1117,1118],{"class":332},"\"${",[247,1120,1121],{"class":319},"HOME",[247,1123,1124],{"class":332},"}",[247,1126,1127],{"class":257},"\u002Fldlist",[247,1129,387],{"class":332},[247,1131,1132],{"class":332},";",[247,1134,1136],{"class":1135},"s7zQu"," if",[247,1138,1139],{"class":332}," [",[247,1141,1142],{"class":332}," -x",[247,1144,1145],{"class":332}," ${",[247,1147,1092],{"class":319},[247,1149,1124],{"class":332},[247,1151,1152],{"class":332}," ];",[247,1154,1155],{"class":1135}," then",[247,1157,1158],{"class":253}," mv",[247,1160,1145],{"class":332},[247,1162,1092],{"class":319},[247,1164,1124],{"class":332},[247,1166,1145],{"class":332},[247,1168,1092],{"class":319},[247,1170,1124],{"class":332},[247,1172,1173],{"class":257},".bak",[247,1175,1132],{"class":332},[247,1177,1178],{"class":1135},"fi\n",[247,1180,1181,1184,1186,1188,1190,1192,1194,1196,1198,1201,1203,1205,1207,1209,1212,1214,1216,1218,1220,1222,1224,1226,1228,1230,1232,1234,1236,1238,1240,1242,1244,1246,1248,1250],{"class":249,"line":313},[247,1182,1183],{"class":319},"TMPFILE2",[247,1185,316],{"class":332},[247,1187,659],{"class":332},[247,1189,1099],{"class":253},[247,1191,659],{"class":332},[247,1193,1104],{"class":332},[247,1195,1107],{"class":319},[247,1197,1110],{"class":332},[247,1199,1200],{"class":319},"  TMPFILE2",[247,1202,316],{"class":332},[247,1204,1118],{"class":332},[247,1206,1121],{"class":319},[247,1208,1124],{"class":332},[247,1210,1211],{"class":257},"\u002Fldlist2",[247,1213,387],{"class":332},[247,1215,1132],{"class":332},[247,1217,1136],{"class":1135},[247,1219,1139],{"class":332},[247,1221,1142],{"class":332},[247,1223,1145],{"class":332},[247,1225,1183],{"class":319},[247,1227,1124],{"class":332},[247,1229,1152],{"class":332},[247,1231,1155],{"class":1135},[247,1233,1158],{"class":253},[247,1235,1145],{"class":332},[247,1237,1183],{"class":319},[247,1239,1124],{"class":332},[247,1241,1145],{"class":332},[247,1243,1183],{"class":319},[247,1245,1124],{"class":332},[247,1247,1173],{"class":257},[247,1249,1132],{"class":332},[247,1251,1178],{"class":1135},[15,1253,1254,1255,1258],{},"You need to remove \"",[25,1256,1257],{},"\u002Fdev\u002Fnull","\" like this:",[238,1260,1262],{"className":240,"code":1261,"language":242,"meta":195,"style":195},"TMPFILE1=`mktemp` ||  TMPFILE1=\"${HOME}\u002Fldlist\"; if [ -x ${TMPFILE1} ]; then mv ${TMPFILE1} ${TMPFILE1}.bak;fi\nTMPFILE2=`mktemp` ||  TMPFILE2=\"${HOME}\u002Fldlist2\"; if [ -x ${TMPFILE2} ]; then mv ${TMPFILE2} ${TMPFILE2}.bak;fi\n",[244,1263,1264,1331],{"__ignoreMap":195},[247,1265,1266,1268,1270,1272,1274,1276,1279,1281,1283,1285,1287,1289,1291,1293,1295,1297,1299,1301,1303,1305,1307,1309,1311,1313,1315,1317,1319,1321,1323,1325,1327,1329],{"class":249,"line":250},[247,1267,1092],{"class":319},[247,1269,316],{"class":332},[247,1271,659],{"class":332},[247,1273,1099],{"class":253},[247,1275,659],{"class":332},[247,1277,1278],{"class":332}," ||",[247,1280,1113],{"class":319},[247,1282,316],{"class":332},[247,1284,1118],{"class":332},[247,1286,1121],{"class":319},[247,1288,1124],{"class":332},[247,1290,1127],{"class":257},[247,1292,387],{"class":332},[247,1294,1132],{"class":332},[247,1296,1136],{"class":1135},[247,1298,1139],{"class":332},[247,1300,1142],{"class":332},[247,1302,1145],{"class":332},[247,1304,1092],{"class":319},[247,1306,1124],{"class":332},[247,1308,1152],{"class":332},[247,1310,1155],{"class":1135},[247,1312,1158],{"class":253},[247,1314,1145],{"class":332},[247,1316,1092],{"class":319},[247,1318,1124],{"class":332},[247,1320,1145],{"class":332},[247,1322,1092],{"class":319},[247,1324,1124],{"class":332},[247,1326,1173],{"class":257},[247,1328,1132],{"class":332},[247,1330,1178],{"class":1135},[247,1332,1333,1335,1337,1339,1341,1343,1345,1347,1349,1351,1353,1355,1357,1359,1361,1363,1365,1367,1369,1371,1373,1375,1377,1379,1381,1383,1385,1387,1389,1391,1393,1395],{"class":249,"line":313},[247,1334,1183],{"class":319},[247,1336,316],{"class":332},[247,1338,659],{"class":332},[247,1340,1099],{"class":253},[247,1342,659],{"class":332},[247,1344,1278],{"class":332},[247,1346,1200],{"class":319},[247,1348,316],{"class":332},[247,1350,1118],{"class":332},[247,1352,1121],{"class":319},[247,1354,1124],{"class":332},[247,1356,1211],{"class":257},[247,1358,387],{"class":332},[247,1360,1132],{"class":332},[247,1362,1136],{"class":1135},[247,1364,1139],{"class":332},[247,1366,1142],{"class":332},[247,1368,1145],{"class":332},[247,1370,1183],{"class":319},[247,1372,1124],{"class":332},[247,1374,1152],{"class":332},[247,1376,1155],{"class":1135},[247,1378,1158],{"class":253},[247,1380,1145],{"class":332},[247,1382,1183],{"class":319},[247,1384,1124],{"class":332},[247,1386,1145],{"class":332},[247,1388,1183],{"class":319},[247,1390,1124],{"class":332},[247,1392,1173],{"class":257},[247,1394,1132],{"class":332},[247,1396,1178],{"class":1135},[15,1398,1399],{},"The second problem is in the library paths:",[238,1401,1403],{"className":240,"code":1402,"language":242,"meta":195,"style":195},"elif [ \"$DISTRO\" = DEBIAN ]; then\n  cp \u002Flib\u002Flibnss_compat.so.2 \u002Flib\u002Flibnsl.so.1 \u002Flib\u002Flibnss_files.so.2 \u002Flib\u002Flibcap.so.1 \u002Flib\u002Flibnss_dns.so.2 ${JAILPATH}\u002Flib\u002F\nelse\n  cp \u002Flib\u002Flibnss_compat.so.2 \u002Flib\u002Flibnsl.so.1 \u002Flib\u002Flibnss_files.so.2 \u002Flib\u002Flibcap.so.1 \u002Flib\u002Flibnss_dns.so.2 ${JAILPATH}\u002Flib\u002F\nfi\n",[244,1404,1405,1431,1461,1466,1488],{"__ignoreMap":195},[247,1406,1407,1410,1412,1414,1417,1419,1422,1425,1428],{"class":249,"line":250},[247,1408,1409],{"class":1135},"elif",[247,1411,1139],{"class":332},[247,1413,333],{"class":332},[247,1415,1416],{"class":319},"$DISTRO",[247,1418,387],{"class":332},[247,1420,1421],{"class":332}," =",[247,1423,1424],{"class":319}," DEBIAN ",[247,1426,1427],{"class":332},"];",[247,1429,1430],{"class":1135}," then\n",[247,1432,1433,1436,1439,1442,1445,1448,1451,1453,1456,1458],{"class":249,"line":313},[247,1434,1435],{"class":253},"  cp",[247,1437,1438],{"class":257}," \u002Flib\u002Flibnss_compat.so.2",[247,1440,1441],{"class":257}," \u002Flib\u002Flibnsl.so.1",[247,1443,1444],{"class":257}," \u002Flib\u002Flibnss_files.so.2",[247,1446,1447],{"class":257}," \u002Flib\u002Flibcap.so.1",[247,1449,1450],{"class":257}," \u002Flib\u002Flibnss_dns.so.2",[247,1452,1145],{"class":332},[247,1454,1455],{"class":319},"JAILPATH",[247,1457,1124],{"class":332},[247,1459,1460],{"class":257},"\u002Flib\u002F\n",[247,1462,1463],{"class":249,"line":642},[247,1464,1465],{"class":1135},"else\n",[247,1467,1468,1470,1472,1474,1476,1478,1480,1482,1484,1486],{"class":249,"line":651},[247,1469,1435],{"class":253},[247,1471,1438],{"class":257},[247,1473,1441],{"class":257},[247,1475,1444],{"class":257},[247,1477,1447],{"class":257},[247,1479,1450],{"class":257},[247,1481,1145],{"class":332},[247,1483,1455],{"class":319},[247,1485,1124],{"class":332},[247,1487,1460],{"class":257},[247,1489,1490],{"class":249,"line":671},[247,1491,1178],{"class":1135},[15,1493,1494],{},"We end up with paths for the x86 version, so we need to adapt them to our x64 system:",[238,1496,1498],{"className":240,"code":1497,"language":242,"meta":195,"style":195},"elif [ \"$DISTRO\" = DEBIAN ]; then\n  cp \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_compat.so.2 \u002Flib\u002Fx86_64-linux-gnu\u002Flibnsl.so.1 \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_files.so.2 \u002Flib\u002Fx86_64-linux-$\nelse\n  cp \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_compat.so.2 \u002Flib\u002Fx86_64-linux-gnu\u002Flibnsl.so.1 \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_files.so.2 \u002Flib\u002Fx86_64-linux-$\nfi\n",[244,1499,1500,1520,1539,1543,1557],{"__ignoreMap":195},[247,1501,1502,1504,1506,1508,1510,1512,1514,1516,1518],{"class":249,"line":250},[247,1503,1409],{"class":1135},[247,1505,1139],{"class":332},[247,1507,333],{"class":332},[247,1509,1416],{"class":319},[247,1511,387],{"class":332},[247,1513,1421],{"class":332},[247,1515,1424],{"class":319},[247,1517,1427],{"class":332},[247,1519,1430],{"class":1135},[247,1521,1522,1524,1527,1530,1533,1536],{"class":249,"line":313},[247,1523,1435],{"class":253},[247,1525,1526],{"class":257}," \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_compat.so.2",[247,1528,1529],{"class":257}," \u002Flib\u002Fx86_64-linux-gnu\u002Flibnsl.so.1",[247,1531,1532],{"class":257}," \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_files.so.2",[247,1534,1535],{"class":257}," \u002Flib\u002Fx86_64-linux-",[247,1537,1538],{"class":319},"$\n",[247,1540,1541],{"class":249,"line":642},[247,1542,1465],{"class":1135},[247,1544,1545,1547,1549,1551,1553,1555],{"class":249,"line":651},[247,1546,1435],{"class":253},[247,1548,1526],{"class":257},[247,1550,1529],{"class":257},[247,1552,1532],{"class":257},[247,1554,1535],{"class":257},[247,1556,1538],{"class":319},[247,1558,1559],{"class":249,"line":671},[247,1560,1178],{"class":1135},[15,1562,1563],{},"Once the issues are fixed, rerun the script with the command:",[238,1565,1567],{"className":240,"code":1566,"language":242,"meta":195,"style":195}," make_chroot_jail.sh jeremie\n",[244,1568,1569],{"__ignoreMap":195},[247,1570,1571,1574],{"class":249,"line":250},[247,1572,1573],{"class":253}," make_chroot_jail.sh",[247,1575,620],{"class":257},[15,1577,1578],{},"Then, the command's output will show:",[238,1580,1582],{"className":240,"code":1581,"language":242,"meta":195,"style":195}," Release: 2008-04-26\n\nAm I root?\n  OK\nChecking distribution...\n  Supported Distribution found\n  System is running Debian Linux\nChecking for which...\n  OK\nChecking for chroot...\n  OK\nChecking for sudo...\n  OK\nChecking for dirname...\n  OK\nChecking for awk...\n  OK\n\nSubsystem sftp \u002Fusr\u002Flib\u002Fopenssh\u002Fsftp-server\n\n-----------------------------\nThe file \u002Fbin\u002Fchroot-shell exists.\nProbably it was created by this script.\n\nAre you sure you want to overwrite it?\n(you want to say yes for example if you are running the script for the second\ntime when adding more than one account to the jail)\n(yes\u002Fno) -> yes\n\nModifying \u002Fetc\u002Fsudoers\nAdding User \"jeremie\" to system\nEnter new UNIX password:\nRetype new UNIX password:\npasswd: password updated successfully\n\nAdding User jeremie to jail\nCopying necessary library-files to jail (may take some time)\nCopying files from \u002Fetc\u002Fpam.d\u002F to jail\nCopying PAM-Modules to jail\n",[244,1583,1584,1592,1598,1609,1614,1622,1633,1650,1660,1664,1673,1677,1686,1690,1699,1703,1712,1716,1720,1731,1736,1742,1757,1781,1786,1812,1858,1870,1888,1893,1902,1921,1935,1946,1960,1965,1979,2010,2028],{"__ignoreMap":195},[247,1585,1586,1589],{"class":249,"line":250},[247,1587,1588],{"class":253}," Release:",[247,1590,1591],{"class":257}," 2008-04-26\n",[247,1593,1594],{"class":249,"line":313},[247,1595,1597],{"emptyLinePlaceholder":1596},true,"\n",[247,1599,1600,1603,1606],{"class":249,"line":642},[247,1601,1602],{"class":253},"Am",[247,1604,1605],{"class":257}," I",[247,1607,1608],{"class":257}," root?\n",[247,1610,1611],{"class":249,"line":651},[247,1612,1613],{"class":253},"  OK\n",[247,1615,1616,1619],{"class":249,"line":671},[247,1617,1618],{"class":253},"Checking",[247,1620,1621],{"class":257}," distribution...\n",[247,1623,1624,1627,1630],{"class":249,"line":687},[247,1625,1626],{"class":253},"  Supported",[247,1628,1629],{"class":257}," Distribution",[247,1631,1632],{"class":257}," found\n",[247,1634,1635,1638,1641,1644,1647],{"class":249,"line":696},[247,1636,1637],{"class":253},"  System",[247,1639,1640],{"class":257}," is",[247,1642,1643],{"class":257}," running",[247,1645,1646],{"class":257}," Debian",[247,1648,1649],{"class":257}," Linux\n",[247,1651,1652,1654,1657],{"class":249,"line":705},[247,1653,1618],{"class":253},[247,1655,1656],{"class":257}," for",[247,1658,1659],{"class":257}," which...\n",[247,1661,1662],{"class":249,"line":713},[247,1663,1613],{"class":253},[247,1665,1666,1668,1670],{"class":249,"line":722},[247,1667,1618],{"class":253},[247,1669,1656],{"class":257},[247,1671,1672],{"class":257}," chroot...\n",[247,1674,1675],{"class":249,"line":731},[247,1676,1613],{"class":253},[247,1678,1679,1681,1683],{"class":249,"line":739},[247,1680,1618],{"class":253},[247,1682,1656],{"class":257},[247,1684,1685],{"class":257}," sudo...\n",[247,1687,1688],{"class":249,"line":748},[247,1689,1613],{"class":253},[247,1691,1692,1694,1696],{"class":249,"line":757},[247,1693,1618],{"class":253},[247,1695,1656],{"class":257},[247,1697,1698],{"class":257}," dirname...\n",[247,1700,1701],{"class":249,"line":766},[247,1702,1613],{"class":253},[247,1704,1705,1707,1709],{"class":249,"line":774},[247,1706,1618],{"class":253},[247,1708,1656],{"class":257},[247,1710,1711],{"class":257}," awk...\n",[247,1713,1714],{"class":249,"line":783},[247,1715,1613],{"class":253},[247,1717,1718],{"class":249,"line":792},[247,1719,1597],{"emptyLinePlaceholder":1596},[247,1721,1723,1726,1728],{"class":249,"line":1722},19,[247,1724,1725],{"class":253},"Subsystem",[247,1727,513],{"class":257},[247,1729,1730],{"class":257}," \u002Fusr\u002Flib\u002Fopenssh\u002Fsftp-server\n",[247,1732,1734],{"class":249,"line":1733},20,[247,1735,1597],{"emptyLinePlaceholder":1596},[247,1737,1739],{"class":249,"line":1738},21,[247,1740,1741],{"class":253},"-----------------------------\n",[247,1743,1745,1748,1751,1754],{"class":249,"line":1744},22,[247,1746,1747],{"class":253},"The",[247,1749,1750],{"class":257}," file",[247,1752,1753],{"class":257}," \u002Fbin\u002Fchroot-shell",[247,1755,1756],{"class":257}," exists.\n",[247,1758,1760,1763,1766,1769,1772,1775,1778],{"class":249,"line":1759},23,[247,1761,1762],{"class":253},"Probably",[247,1764,1765],{"class":257}," it",[247,1767,1768],{"class":257}," was",[247,1770,1771],{"class":257}," created",[247,1773,1774],{"class":257}," by",[247,1776,1777],{"class":257}," this",[247,1779,1780],{"class":257}," script.\n",[247,1782,1784],{"class":249,"line":1783},24,[247,1785,1597],{"emptyLinePlaceholder":1596},[247,1787,1789,1792,1795,1798,1800,1803,1806,1809],{"class":249,"line":1788},25,[247,1790,1791],{"class":253},"Are",[247,1793,1794],{"class":257}," you",[247,1796,1797],{"class":257}," sure",[247,1799,1794],{"class":257},[247,1801,1802],{"class":257}," want",[247,1804,1805],{"class":257}," to",[247,1807,1808],{"class":257}," overwrite",[247,1810,1811],{"class":257}," it?\n",[247,1813,1815,1818,1821,1823,1825,1828,1831,1833,1836,1838,1840,1843,1845,1848,1851,1853,1855],{"class":249,"line":1814},26,[247,1816,1817],{"class":332},"(",[247,1819,1820],{"class":253},"you",[247,1822,1802],{"class":257},[247,1824,1805],{"class":257},[247,1826,1827],{"class":257}," say",[247,1829,1830],{"class":257}," yes",[247,1832,1656],{"class":257},[247,1834,1835],{"class":257}," example",[247,1837,1136],{"class":257},[247,1839,1794],{"class":257},[247,1841,1842],{"class":257}," are",[247,1844,1643],{"class":257},[247,1846,1847],{"class":257}," the",[247,1849,1850],{"class":257}," script",[247,1852,1656],{"class":257},[247,1854,1847],{"class":257},[247,1856,1857],{"class":257}," second\n",[247,1859,1861,1864,1867],{"class":249,"line":1860},27,[247,1862,1863],{"class":993},"time",[247,1865,1866],{"class":319}," when adding more than one account to the jail",[247,1868,1869],{"class":332},")\n",[247,1871,1873,1875,1878,1881,1883,1885],{"class":249,"line":1872},28,[247,1874,1817],{"class":332},[247,1876,1877],{"class":253},"yes\u002Fno",[247,1879,1880],{"class":332},")",[247,1882,877],{"class":253},[247,1884,320],{"class":319},[247,1886,1887],{"class":257},"yes\n",[247,1889,1891],{"class":249,"line":1890},29,[247,1892,1597],{"emptyLinePlaceholder":1596},[247,1894,1896,1899],{"class":249,"line":1895},30,[247,1897,1898],{"class":253},"Modifying",[247,1900,1901],{"class":257}," \u002Fetc\u002Fsudoers\n",[247,1903,1905,1907,1910,1912,1914,1916,1918],{"class":249,"line":1904},31,[247,1906,630],{"class":253},[247,1908,1909],{"class":257}," User",[247,1911,333],{"class":332},[247,1913,662],{"class":257},[247,1915,387],{"class":332},[247,1917,1805],{"class":257},[247,1919,1920],{"class":257}," system\n",[247,1922,1924,1926,1929,1932],{"class":249,"line":1923},32,[247,1925,699],{"class":253},[247,1927,1928],{"class":257}," new",[247,1930,1931],{"class":257}," UNIX",[247,1933,1934],{"class":257}," password:\n",[247,1936,1938,1940,1942,1944],{"class":249,"line":1937},33,[247,1939,708],{"class":253},[247,1941,1928],{"class":257},[247,1943,1931],{"class":257},[247,1945,1934],{"class":257},[247,1947,1949,1951,1954,1957],{"class":249,"line":1948},34,[247,1950,716],{"class":253},[247,1952,1953],{"class":257}," password",[247,1955,1956],{"class":257}," updated",[247,1958,1959],{"class":257}," successfully\n",[247,1961,1963],{"class":249,"line":1962},35,[247,1964,1597],{"emptyLinePlaceholder":1596},[247,1966,1968,1970,1972,1974,1976],{"class":249,"line":1967},36,[247,1969,630],{"class":253},[247,1971,1909],{"class":257},[247,1973,1031],{"class":257},[247,1975,1805],{"class":257},[247,1977,1978],{"class":257}," jail\n",[247,1980,1982,1985,1988,1991,1993,1996,1999,2002,2005,2008],{"class":249,"line":1981},37,[247,1983,1984],{"class":253},"Copying",[247,1986,1987],{"class":257}," necessary",[247,1989,1990],{"class":257}," library-files",[247,1992,1805],{"class":257},[247,1994,1995],{"class":257}," jail",[247,1997,1998],{"class":319}," (may ",[247,2000,2001],{"class":257},"take",[247,2003,2004],{"class":257}," some",[247,2006,2007],{"class":257}," time",[247,2009,1869],{"class":319},[247,2011,2013,2015,2018,2021,2024,2026],{"class":249,"line":2012},38,[247,2014,1984],{"class":253},[247,2016,2017],{"class":257}," files",[247,2019,2020],{"class":257}," from",[247,2022,2023],{"class":257}," \u002Fetc\u002Fpam.d\u002F",[247,2025,1805],{"class":257},[247,2027,1978],{"class":257},[247,2029,2031,2033,2036,2038],{"class":249,"line":2030},39,[247,2032,1984],{"class":253},[247,2034,2035],{"class":257}," PAM-Modules",[247,2037,1805],{"class":257},[247,2039,1978],{"class":257},[15,2041,2042],{},"If you browse the jail folder:",[238,2044,2046],{"className":240,"code":2045,"language":242,"meta":195,"style":195},"ls -al \u002Fhome\u002Fjail\n",[244,2047,2048],{"__ignoreMap":195},[247,2049,2050,2052,2055],{"class":249,"line":250},[247,2051,894],{"class":253},[247,2053,2054],{"class":257}," -al",[247,2056,2057],{"class":257}," \u002Fhome\u002Fjail\n",[15,2059,2060,2061,2063],{},"You'll see the work done by the fuschlberger script.",[34,2062],{},"\nTry logging in with the user you previously created:",[238,2065,2066],{"className":240,"code":867,"language":242,"meta":195,"style":195},[244,2067,2068],{"__ignoreMap":195},[247,2069,2070,2072,2074],{"class":249,"line":250},[247,2071,874],{"class":253},[247,2073,877],{"class":257},[247,2075,620],{"class":257},[15,2077,387,2078,2081],{},[25,2079,2080],{},"su: module is unknown","\" error:",[238,2083,2085],{"className":240,"code":2084,"language":242,"meta":195,"style":195}," su: Module is unknown\n",[244,2086,2087],{"__ignoreMap":195},[247,2088,2089,2092,2095,2097],{"class":249,"line":250},[247,2090,2091],{"class":253}," su:",[247,2093,2094],{"class":257}," Module",[247,2096,1640],{"class":257},[247,2098,2099],{"class":257}," unknown\n",[15,2101,2102,2103,2106],{},"The solution I found is to edit the ",[25,2104,2105],{},"chroot-shell"," file:",[238,2108,2110],{"className":240,"code":2109,"language":242,"meta":195,"style":195},"nano \u002Fbin\u002Fchroot-shell\n",[244,2111,2112],{"__ignoreMap":195},[247,2113,2114,2116],{"class":249,"line":250},[247,2115,529],{"class":253},[247,2117,2118],{"class":257}," \u002Fbin\u002Fchroot-shell\n",[15,2120,2121],{},"Initially you'll find this inside:",[238,2123,2125],{"className":240,"code":2124,"language":242,"meta":195,"style":195},"#!\u002Fbin\u002Fbash \n\u002Fusr\u002Fbin\u002Fsudo \u002Fusr\u002Fsbin\u002Fchroot \u002Fhome\u002Fjail \u002Fbin\u002Fsu - $USER \"$@\"\n",[244,2126,2127,2133],{"__ignoreMap":195},[247,2128,2129],{"class":249,"line":250},[247,2130,2132],{"class":2131},"sHwdD","#!\u002Fbin\u002Fbash \n",[247,2134,2135,2138,2141,2143,2146,2148,2151,2153,2157],{"class":249,"line":313},[247,2136,2137],{"class":253},"\u002Fusr\u002Fbin\u002Fsudo",[247,2139,2140],{"class":257}," \u002Fusr\u002Fsbin\u002Fchroot",[247,2142,498],{"class":257},[247,2144,2145],{"class":257}," \u002Fbin\u002Fsu",[247,2147,877],{"class":257},[247,2149,2150],{"class":319}," $USER ",[247,2152,387],{"class":332},[247,2154,2156],{"class":2155},"sHdIc","$@",[247,2158,339],{"class":332},[15,2160,2161],{},"The change to make:",[238,2163,2165],{"className":240,"code":2164,"language":242,"meta":195,"style":195},"#!\u002Fbin\u002Fbash\nsudo \u002Fusr\u002Fsbin\u002Fchroot \u002Fhome\u002Fjail \u002Fbin\u002Fbash\n",[244,2166,2167,2172],{"__ignoreMap":195},[247,2168,2169],{"class":249,"line":250},[247,2170,2171],{"class":2131},"#!\u002Fbin\u002Fbash\n",[247,2173,2174,2177,2179,2181],{"class":249,"line":313},[247,2175,2176],{"class":253},"sudo",[247,2178,2140],{"class":257},[247,2180,498],{"class":257},[247,2182,2183],{"class":257}," \u002Fbin\u002Fbash\n",[15,2185,2186],{},"Then you need to rerun the command:",[238,2188,2189],{"className":240,"code":867,"language":242,"meta":195,"style":195},[244,2190,2191],{"__ignoreMap":195},[247,2192,2193,2195,2197],{"class":249,"line":250},[247,2194,874],{"class":253},[247,2196,877],{"class":257},[247,2198,620],{"class":257},[15,2200,2201,2202,2205,2206,2208,2209,2212],{},"You should now be ",[25,2203,2204],{},"logged in"," with no errors, and you're indeed inside your jail.",[34,2207],{},"\nHowever, you have a ",[25,2210,2211],{},"restricted list of commands",", to add more: edit the script!",[238,2214,2216],{"className":240,"code":2215,"language":242,"meta":195,"style":195},"nano \u002Fusr\u002Flocal\u002Fsbin make_chroot_jail.sh\n",[244,2217,2218],{"__ignoreMap":195},[247,2219,2220,2222,2225],{"class":249,"line":250},[247,2221,529],{"class":253},[247,2223,2224],{"class":257}," \u002Fusr\u002Flocal\u002Fsbin",[247,2226,997],{"class":257},[15,2228,2229,2230,2233,2234,2237],{},"Search for the \"",[25,2231,2232],{},"APPS","\" line with \"",[25,2235,2236],{},"ctrl + w","\" and add the path of the commands you want.",[238,2239,2241],{"className":240,"code":2240,"language":242,"meta":195,"style":195},"elif [ \"$DISTRO\" = DEBIAN ]; then\n  APPS=\"\u002Fbin\u002Fbash \u002Fbin\u002Fcrontab \u002Fbin\u002Fvim \u002Fbin\u002Fmysql \u002Fbin\u002Fhg \u002Fbin\u002Fhg-ssh \u002Fusr\u002Fbin\u002Fclear \u002Fusr\u002Fbin\u002Fncurses5-config \u002Fbin\u002Fnano \u002Fbin\u002Fcp \u002Fusr\u002Fbin\u002F \u002Fbin\u002Fls \u002Fbin\u002Fmkdir \u002Fbin\u002Fmv \u002Fbin\u002Frm \u002Fbin\u002Frmdir \u002Fbin\u002Fsh \u002Fbin\u002Fping  \u002Fbin\u002Fsu \u002Fusr\u002Fbin\u002Fgroups \u002Fusr\u002Fbin\u002Fid \u002Fusr\u002Fbin\u002Frsync \u002Fusr\u002Fbin\u002Fssh \u002Fusr\u002Fbin\u002Fscp \u002Fsbin\u002Funix_chkpwd\"\n",[244,2242,2243,2263],{"__ignoreMap":195},[247,2244,2245,2247,2249,2251,2253,2255,2257,2259,2261],{"class":249,"line":250},[247,2246,1409],{"class":1135},[247,2248,1139],{"class":332},[247,2250,333],{"class":332},[247,2252,1416],{"class":319},[247,2254,387],{"class":332},[247,2256,1421],{"class":332},[247,2258,1424],{"class":319},[247,2260,1427],{"class":332},[247,2262,1430],{"class":1135},[247,2264,2265,2268,2270,2272,2275],{"class":249,"line":313},[247,2266,2267],{"class":319},"  APPS",[247,2269,316],{"class":332},[247,2271,387],{"class":332},[247,2273,2274],{"class":257},"\u002Fbin\u002Fbash \u002Fbin\u002Fcrontab \u002Fbin\u002Fvim \u002Fbin\u002Fmysql \u002Fbin\u002Fhg \u002Fbin\u002Fhg-ssh \u002Fusr\u002Fbin\u002Fclear \u002Fusr\u002Fbin\u002Fncurses5-config \u002Fbin\u002Fnano \u002Fbin\u002Fcp \u002Fusr\u002Fbin\u002F \u002Fbin\u002Fls \u002Fbin\u002Fmkdir \u002Fbin\u002Fmv \u002Fbin\u002Frm \u002Fbin\u002Frmdir \u002Fbin\u002Fsh \u002Fbin\u002Fping  \u002Fbin\u002Fsu \u002Fusr\u002Fbin\u002Fgroups \u002Fusr\u002Fbin\u002Fid \u002Fusr\u002Fbin\u002Frsync \u002Fusr\u002Fbin\u002Fssh \u002Fusr\u002Fbin\u002Fscp \u002Fsbin\u002Funix_chkpwd",[247,2276,339],{"class":332},[15,2278,2279],{},"Then, you need to update your jail with the script:",[238,2281,2283],{"className":240,"code":2282,"language":242,"meta":195,"style":195},"make_chroot_jail.sh update\n",[244,2284,2285],{"__ignoreMap":195},[247,2286,2287,2289],{"class":249,"line":250},[247,2288,1010],{"class":253},[247,2290,2291],{"class":257}," update\n",[15,2293,2294,2295,364],{},"Also, if you want to resolve domain names you'll need to add the ",[25,2296,2297],{},"DNS library",[238,2299,2301],{"className":240,"code":2300,"language":242,"meta":195,"style":195},"cp \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_dns.so.2 \u002Fhome\u002Fjail\u002Flib\n",[244,2302,2303],{"__ignoreMap":195},[247,2304,2305,2308,2311],{"class":249,"line":250},[247,2306,2307],{"class":253},"cp",[247,2309,2310],{"class":257}," \u002Flib\u002Fx86_64-linux-gnu\u002Flibnss_dns.so.2",[247,2312,2313],{"class":257}," \u002Fhome\u002Fjail\u002Flib\n",[15,2315,2316,2317,32],{},"This script is a bit dated but makes for a good base to get started with ",[25,2318,2319],{},"jail\u002Fchroot",[10,2321,2323],{"id":2322},"conclusion","Conclusion",[15,2325,2326,2327,2329],{},"I've compared here two methods for jailing an SSH user on Linux: the Jailkit script, more recent and maintained, and the fuschlberger script, older but still functional with a few adjustments for the 64-bit version. These chroot\u002Fjail techniques let you provide restricted access to a production server without exposing its entire directory tree, which strengthens security and confidentiality during external collaborations. One point to watch: the list of commands available inside the jail should be adjusted sparingly so as not to recreate an environment that's too open.\nPersonally, I stopped there and didn't look into the other possible options.",[34,2328],{},"\nYou now know how to use these two scripts! Share your feedback in the comments section.",[2331,2332,2333],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}",{"title":195,"searchDepth":313,"depth":313,"links":2335},[2336,2337,2338,2339,2340,2343],{"id":12,"depth":313,"text":13},{"id":20,"depth":313,"text":21},{"id":92,"depth":313,"text":93},{"id":224,"depth":313,"text":225},{"id":929,"depth":313,"text":930,"children":2341},[2342],{"id":1058,"depth":642,"text":1059},{"id":2322,"depth":313,"text":2323},null,"\u002Fimages\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux\u002F5e5571284a.png","2014-02-23","Understand the chroot\u002Fjail technique on Linux. Restricted access for your SSH users. Use Jailkit or the fuschlberger script!","md",{},"\u002Fen\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux",{"title":5,"description":2347},"emprisonner-utilisateur-ssh-sous-linux","en\u002Fblog\u002Femprisonner-utilisateur-ssh-sous-linux","1Z6qPVOVxdPkFtGnBwfvjaXJTl6mw_fsek0OmZZr7hg",[2356,2364,2372,2378,2385,2392,2398,2403],{"title":2357,"path":2358,"stem":2359,"date":2360,"cover":2361,"categories":2362,"children":-1},"Configuring an SRX100 Gateway via J-Web","\u002Fen\u002Fblog\u002Fconfiguration-une-passerelle-srx100-sous-web","en\u002Fblog\u002Fconfiguration-une-passerelle-srx100-sous-web","2014-07-10","\u002Fimages\u002Fblog\u002Fconfiguration-une-passerelle-srx100-sous-web\u002F1b4814003c.jpg",[2363],"Réseau",{"title":2365,"path":2366,"stem":2367,"date":2368,"cover":2369,"categories":2370,"children":-1},"Hack In Paris and Nuit du Hack, June 26-29, 2014","\u002Fen\u002Fblog\u002Fhack-paris-nuit-hack-juin-2014","en\u002Fblog\u002Fhack-paris-nuit-hack-juin-2014","2014-04-11","\u002Fimages\u002Fblog\u002Fhack-paris-nuit-hack-juin-2014\u002Fd1c6cbea4e.jpg",[2371],"Évènement",{"title":2373,"path":2374,"stem":2375,"date":2376,"cover":2377,"categories":2344,"children":-1},"Configuring ruTorrent's Web Interface with Apache2","\u002Fen\u002Fblog\u002Fconfigurer-interface-web-rutorrent-avec-apache2","en\u002Fblog\u002Fconfigurer-interface-web-rutorrent-avec-apache2","2014-03-31","\u002Fimages\u002Fblog\u002Fconfigurer-interface-web-rutorrent-avec-apache2\u002F672919258b.png",{"title":2379,"path":2380,"stem":2381,"date":2382,"cover":2383,"categories":2384,"children":-1},"The Destruction of Net Neutrality Is Underway: Get Angry!","\u002Fen\u002Fblog\u002Fdestruction-neutralite-net-est-marche-indignez-vous","en\u002Fblog\u002Fdestruction-neutralite-net-est-marche-indignez-vous","2014-03-23","\u002Fimages\u002Fblog\u002Fdestruction-neutralite-net-est-marche-indignez-vous\u002Fddb702d91a.jpg",[2371],{"title":2386,"path":2387,"stem":2388,"date":2389,"cover":2390,"categories":2391,"children":-1},"Discover the Magic: Adobe Creative Cloud!","\u002Fen\u002Fblog\u002Fdecouvrez-magie-adobe-creative-cloud","en\u002Fblog\u002Fdecouvrez-magie-adobe-creative-cloud","2014-02-06","\u002Fimages\u002Fblog\u002Fdecouvrez-magie-adobe-creative-cloud\u002Fc5befd8385.jpg",[2371],{"title":2393,"path":2394,"stem":2395,"date":2396,"cover":2397,"categories":2344,"children":-1},"The Fitbit Force, a Pioneer of Connected Wristbands","\u002Fen\u002Fblog\u002Ffitbit-force-precurseur-des-bracelets-connectes","en\u002Fblog\u002Ffitbit-force-precurseur-des-bracelets-connectes","2014-01-29","\u002Fimages\u002Fblog\u002Ffitbit-force-precurseur-des-bracelets-connectes\u002F591236ebce.jpg",{"title":2399,"path":2400,"stem":2401,"date":2396,"cover":2402,"categories":2344,"children":-1},"Installing Plex Media Server on Debian 8","\u002Fen\u002Fblog\u002Finstallation-plex-media-server-sur-debian","en\u002Fblog\u002Finstallation-plex-media-server-sur-debian","\u002Fimages\u002Fblog\u002Finstallation-plex-media-server-sur-debian\u002Fea86a7e30d.png",{"title":2404,"path":2405,"stem":2406,"date":2407,"cover":2408,"categories":2344,"children":-1},"Installing Splunk on Debian 7","\u002Fen\u002Fblog\u002Finstallation-splunk-sur-debian","en\u002Fblog\u002Finstallation-splunk-sur-debian","2014-01-14","\u002Fimages\u002Fblog\u002Finstallation-splunk-sur-debian\u002Ff8405ad901.jpg",[],1786644891153]