need chroot help 1

[frozenpeas]

Hi,

I am running RH 7.0 and ProFTPd 1.2.4.

When users login, I want to keep them from moving above their own directory (/home/username/). I think this can be done with chroot but I have no idea how.

Can someone give me a walkthrough?

Thanks.

 

[pcunix]

That can also be done with rsh.

Or don't let them have shell access at all- make their shell whatever application they need to run if that's appropriate.

Setting up a chroot environment involves making a directory that has the necessary files under it to work: /etc/passwd (generally modified from the original), necessary libraries etc.

http://www.linuxdoc.org/HOWTO/Chroot-BIND8-HOWTO.html

describes doing this for a sendmail "user"; the same concepts apply to any user.


A more generic treatment is

http://www.gnumonks.org/ftp/pub/netfilter/doc/chroot-howto.html

A

http://www.google.com"

search for "llinux chroot how-to" will turn up many others.
Tony Lawrence
SCO Unix/Linux Resources

http://pcunix.com

tony@pcunix.com

 

[frozenpeas]

Thanks!

 

[marsd]

An easy way to do this is to use the -r option for
bash if they are using this shell.
bash -r restricts any number of things that they can do.

 

[PcLinuxGuru]

There is an easier way.... Your using ProFTPD...

Well in my proftpd.conf file I added this to my global (showing you the whole thing):

<Directory /*>
AllowOverwrite off
HideGroup root
<Limit ALL>
IgnoreHidden on
</Limit>
</Directory>

The HideGroup option hides anything that has a group of root. If you ONLY add that the files will appear to be invisible but is still susceptible to any commands like copy, erase, etc.... So I added the Limit

<Limit ALL> is the option that limits commands... you can specify certain commands but for my root files ALL is good.

The IgnoreHidden command tells it to ignore the command for the hidden files.

Now when someone logs in.. They change the directory up to /Home (for me) they can see all the other home users but by permissions they can't access the other directories. If they try to go up again they get the access denied as well as if they phsically type it in there.

If you serve an anoymous ftp server I would also add the HiddenGroup and Limit in the Anonymous section of the proftpd.conf file. Don't forget to restart the ftp server after you make changes.

Here is a site with all of the ProFtpd Directives:

http://www.proftpd.org/docs/configuration.html

Good Luck
Bill