disable port forwarding in OpenSSH

[Alexey Koptsevich]

> chroot is almost certainly more secure.  Unless you're root, it's usually
> not possible to get out of a chroot.  However, chroot is a lot harder to
> manage, so sometimes admins try to do "clever" tricks which end up
> subverting their security rather than enhancing it.  A restricted shell is
> way easier to build and manage and is frequently secure enough for most
> people.

OK, I see. But I do not do any tricks. I just copy all binaries needed,
then all libraries and all config files needed for those binaries, to the
direcrtory which contains mail folders. Then I chroot to it.

> > Thanks! But if no shell -- no ability, right?
> 
> I'm not sure I understand.  The user has to have some "shell" that can be
> invoked as "<shell> -c pine" and do the right thing.  If you don't disable
> suspend in the pine.conf.fixed, then pine will either fork a new instance
> of <shell> (which is safe if <shell> is a restricted shell which just
> exits when invoked without "-c pine") or else it will try to detach from
> the restricted shell, which won't work right.

OK, but if I set /usr/local/bin/pine (or /usr/local/bin/mutt) as a shell
in the /etc/passwd and do not copy any shell to the chroot-ed directory at
all -- there is no ability to run it, that's what I meant. Of course, if
one excludes buffer overflow possibility...

Thanks,
Alex