Feature request

[Derek Simkowiak]

/The sshd server has what I think is a serious flaw./

   Doug,
    OpenSSH server does not support chroot shell access.  It only 
supports a read-only chroot jail for SFTP (a brand-new feature which, I 
submit, is mostly useless).  So, whatever chroot problem you are having 
is not related to OpenSSH.  You're on the wrong list.

    Having said that, I am a user of the chroot patch for SSH available 
from http://chrootssh.sourceforge.net/ .  Earlier this week I proposed 
that this patch be included with OpenSSH as a compile-time option.  It's 
extremely useful (for many people, not just me) and it's been deployed 
out in the wild for a long time.  It uses the same /./ chroot convention 
used by wuftp and chrsh.

    If that is the patch you are using -- you never mentioned how you 
were doing chroot with SSH -- then know that I am NOT able to reproduce 
your problem.

    Here I log in as a chroot'd user (username: admin, using a 
password).  Note that the file /etc/passwd only has two lines, because 
it's the fake passwd file in the chroot jail:  

dereks at dell-laptop:~$ ssh admin at cst2 "cat /etc/passwd"
admin at cst2's password:
root:x:0:0:root:/root:/bin/bash
admin:x:10001:10001:Administrator:/var/www/web1/./:/bin/bash

    And here I log in as a non-chroot'd user (username: root, using an 
authorized key).  Note that the local /etc/passwd now has 42 lines, 
because it's the real passwd file at /etc/passwd:  
  
dereks at dell-laptop:~$ ssh root at cst2 "cat /etc/passwd | wc"
     42      61    2040
dereks at dell-laptop:~$

    Ergo, your problem is not with OpenSSH, and it's not even with the 
patch at http://chrootssh.sourceforge.net/.  You need to keep looking.  
(To the best of my knowledge, if you're not using that patch, you will 
never get chroot SSH access for your users.)

    As an aside, note that my box "cst2" is running ISPConfig, which 
conveniently supports the above chroot patch, and which automatically 
creates a chroot jail for all new users (and puts the /./ syntax into 
their home directory) using its web-based GUI.

    Please do not reply to the OpenSSH list, because (again) this is the 
wrong list for your question.  Feel free to reply to me privately if you 
need further assistance.

Thanks,
Derek

P.S.> Yes, root shell with an authorized key.  Please don't berate me 
about it.  It's a dev system and I need convenient root access, so sue me.

Doug Poulin wrote:
> The sshd server has what I think is a serious flaw.  There appears to be no way to turn off remote command execution.  (someone please correct me if I am wrong).
>
> We have a server which uses a chroot jail, and rbash to severely limit what users can do on our system.  The remote command bypasses all of that.
>
> ie.  ssh user at host cat /etc/passwd  will display the password file for the live system and not the chrooted jail.
>
> I've checked the man pages and so far I haven't seen anything that will allow me to override this functionality.  We may be able to use the public/private key with the command override feature, but I'd rather the problem was addressed properly.
>
> Comments?
> Doug
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>