各位先進好︰
最近想將ssh使用者限制在家目錄,並限制使用者能執行的指令。
環境為Fedora 1 , OpenSSH_3.7.1p1 並使用jailkit 這個工具。
參照官方網站的作法︰
http://olivier.sessink.nl/jailkit/jailkit.8.html #創建目錄
mkdir /home/forjail
chown root:root /home/forjail
chmod 0755 /home/forjail
jk_init /home/forjail jk_lsh
# 創建帳號
jk_addjailuser -p /home/forjail/ dojail
please enter the jail directory:
/home/forjail
# 編輯 /home/forjail/etc/jk_lsh.ini
[DEFAULT]
executables = /usr/bin/scp, /usr/lib/sftp-server, /usr/bin/rsync,/usr/sbin/jk_lsh
paths = /usr/bin/, /usr/lib
allow_word_expansion = 1
##/etc/passwd
dojail:x:508:100::/home/forjail/./home/dojail:/usr/sbin/jk_chrootsh
服務重啟
# test the account
$ssh -l dojail 1.1.1.1
dojail@1.1.1.1password:
Last login: Thu Jan 15 17:29:53 from 2.2.2.2.hinet-ip.hinet.net
Connection to 1.1.1.1 closed.
一下就被closed 看了一下 syslogJan 15 17:35:47 michael sshd[8288]: Accepted password for dojail from 2.2.2.2 port 33054 ssh2
Jan 15 17:35:47 michael sshd(pam_unix)[8288]: session opened for user dojail by (uid=0)
Jan 15 17:35:47 michael login(pam_unix)[8289]: session opened for user dojail by (uid=0)
Jan 15 17:35:47 michael login -- dojail[8289]: LOGIN ON pts/0 BY dojail FROM 1.1.1.1.hinet-ip.hinet.net
Jan 15 17:35:47 michael jk_chrootsh[8290]: now entering jail /home/forjail for user dojail (508)
Jan 15 09:35:47 michael jk_lsh[8290]: jk_lsh version 2.1, started
Jan 15 09:35:47 michael jk_lsh[8290]:
WARNING: user dojail (508) tried to get an interactive shell session (/usr/sbin/jk_lsh), which is never allowed by jk_lshJan 15 17:35:47 michael login(pam_unix)[8289]: session closed for user dojail
Jan 15 17:35:47 michael sshd(pam_unix)[8288]: session closed for user dojail
不知各位先進們是否跟我與到一樣的問題,我在jk_lsh.ini 己經設定 /usr/sbin/jk_lsh 的路徑,權限也是 755
這個錯誤訊息始終參不透
或是各位有什麼別的作法,謝謝大家。