No es la primera vez que me peleo con rssh para permitir a un usuario "rssh_user" acceder sólo por sftp o scp a mi ordenador y tenerle enjaulado en su home.
Describo la configuración que tengo: #> cat /etc/rssh.conf ----------------------------------------------------------------------------------------- logfacility = LOG_USER allowscp allowsftp umask = 022 chrootpath = "/home/jaula" #Permitimos scp y sftp: user=rssh_user:022:00011:/home/jaula ----------------------------------------------------------------------------------------- #> cat /etc/passwd | grep rssh_user ----------------------------------------------------------------------------------------- rssh_user:x:1002:1002:,,,:/home/jaula/home/rssh_user:/usr/bin/rssh ----------------------------------------------------------------------------------------- He creado el directorio /home/jaula y he copiado en él todas las dependencias de los comandos scp, rssh, rssh_chroot_helper y sftp-server (las he averiguado haciendo "ldd") además de crear los directorios necesarios para el chroot: #> ls -R /home/jaula ----------------------------------------------------------------------------------------- /home/jaula: home lib usr /home/jaula/home: rssh_user /home/jaula/home/rssh_user: /home/jaula/lib: libcom_err.so.2 libselinux.so.1 libsepol.so.1 tls /home/jaula/lib/tls: libcrypt.so.1 libc.so.6 libdl.so.2 libnsl.so.1 libresolv.so.2 libutil.so.1 /home/jaula/usr: bin lib /home/jaula/usr/bin: rssh scp /home/jaula/usr/lib: i686 libgssapi_krb5.so.2 libkrb5.so.3 libkrb5support.so.0 libz.so.1 rssh sftp-server /home/jaula/usr/lib/i686: cmov /home/jaula/usr/lib/i686/cmov: libcrypto.so.0.9.8 /home/jaula/usr/lib/rssh: rssh_chroot_helper ----------------------------------------------------------------------------------------- Entonces si entro por SSH me dice lo siguiente (que a todas luces parece correcto): #> ssh [EMAIL PROTECTED] ----------------------------------------------------------------------------------------- This account is restricted by rssh. Allowed commands: scp sftp If you believe this is in error, please contact your system administrator. Connection to 127.0.0.1 closed. ----------------------------------------------------------------------------------------- Pero se supone que me tendría que dejar entrar por SFTP, y sin embargo me dice: #> sftp [EMAIL PROTECTED] ----------------------------------------------------------------------------------------- Connecting to 127.0.0.1... Password: Connection closed ----------------------------------------------------------------------------------------- Los logs dicen: #> tail -f /var/log/syslog ----------------------------------------------------------------------------------------- Jun 24 19:19:19 aliax rssh[13693]: setting log facility to LOG_USER Jun 24 19:19:19 aliax rssh[13693]: allowing scp to all users Jun 24 19:19:19 aliax rssh[13693]: allowing sftp to all users Jun 24 19:19:19 aliax rssh[13693]: setting umask to 022 Jun 24 19:19:19 aliax rssh[13693]: chrooting all users to /home/jaula Jun 24 19:19:19 aliax rssh[13693]: line 53: configuring user rssh_user Jun 24 19:19:19 aliax rssh[13693]: setting rssh_user's umask to 022 Jun 24 19:19:19 aliax rssh[13693]: allowing scp to user rssh_user Jun 24 19:19:19 aliax rssh[13693]: allowing sftp to user rssh_user Jun 24 19:19:19 aliax rssh[13693]: chrooting rssh_user to /home/jaula Jun 24 19:19:19 aliax rssh[13693]: chroot cmd line: /usr/lib/rssh/rssh_chroot_helper 2 "/usr/lib/openssh/sftp-server" ----------------------------------------------------------------------------------------- #> tail -f /var/log/auth ----------------------------------------------------------------------------------------- Jun 24 19:19:19 aliax sshd[13670]: Accepted keyboard-interactive/pam for rssh_user from 127.0.0.1 port 40996 ssh2 Jun 24 19:19:19 aliax sshd[13692]: (pam_unix) session opened for user rssh_user by (uid=0) Jun 24 19:19:19 aliax sshd[13692]: subsystem request for sftp Jun 24 19:19:19 aliax sshd[13692]: (pam_unix) session closed for user rssh_user ----------------------------------------------------------------------------------------- ¿Alguien sabe qué hago mal? Gracias de antemano. -- Por el bien de todos respetemos las normas de la lista: http://wiki.debian.org/NormasLista
