Failed to su after making a chroot jail

Question

On a 64 bit CentOS host I am using script make_chroot_jail.sh to put a user in a jail, not permitting it to see anything expect it's home at /home/jail/home/user1.

I did it typing this:

sudo ./make_chroot_jail.sh user1

after, when trying to connect to user1 first i was getting an error like:

/bin/su: user guest does not exist

i have fixed this by copying some missed libraries:

sudo cp /lib64/libnss_compat.so.2 /lib64/libnss_files.so.2 /lib64/libnss_dns.so.2 /lib64/libxcrypt.so.2 /home/jail/lib64/
sudo cp -r /lib64/security/ /home/jail/lib64/

But now, when trying to connect to user1 typing su user1 and then typing it's password, i am getting this error:

could not open session

So the question is how to connect to user1 in this situation?

P.S. Here are the permissions of some files, this might be helpful in order to provide a solution:

-rwsr-xr-x 1 root root /home/jail/bin/su
drwxr-xr-x 4 root root /home/jail/etc
-rw-r--r-- 1 root root /home/jail/etc/pam.d/su
-rw-r--r-- 1 root root /home/jail/etc/passwd
-rw------- 1 root root /home/jail/etc/shadow

UPDATE1

After some modifications i managed to connect to user1, but the session closes immediately! I guess this a PAM issue, however cant find a way to fix it.

Here the log entry for close action from /val/log/secure:

Oct  6 15:19:42 localhost su: pam_unix(su:session): session closed for user user1

What makes the session to exit immediately after launching?

Answer 1

To fix the could not open session problem, without abandoning make_chroot_jail.sh entirely, you also need to copy the /usr/lib/libcrack* libraries. Edit the script, where it has:

# If you are using a 64 bit system and have strange problems with login comment
# the following lines in, perhaps it will work (motto: if you can't find the
# needed library just copy all of them)
#
# cp /lib/*.* ${JAILPATH}/lib/
# cp /lib/lib64/*.* ${JAILPATH}/lib/lib64/

Change to:

cp /lib/*.* ${JAILPATH}/lib/
cp /lib64/*.* ${JAILPATH}/lib64/
cp -rp /lib64/security ${JAILPATH}/lib64/
cp /usr/lib64/libcrack* ${JAILPATH}/usr/lib64/

Just a quick addendum, the above fixed this problem with 64 bit SuSE - SLES 11 sp2. I also renamed the $JAILPATH/lib to $JAILPATH/lib64. And for that OS, I had to add an empty /etc/profile file in the jail (you can use it to put in a PS1 prompt).

Answer 2

I have found a solution.

First of all you should forget about make_chroot_jail.sh and use Jailkit.

I have faced some problems while using it, but eventually everything works.

Here are the steps how I used Jailkit and how I fixed the issues which were occurring:

A. Do ./configure; make; make install as it is describes at INSTALL.txt.

B. Add /usr/sbin to the $PATH if it is not already there.

C. Do this:

jk_init -v -j /home/jail basicshell editors extendedshell netutils ssh sftp scp

This may fail with an error message like this:

`ERROR: configfile /usr/jk_init.ini does not exist`

To fix this, at /usr/sbin/jk_init change INIPREFIX='/usr' to INIPREFIX='/etc/jailkit' and try again.

D. Do this:

jk_jailuser -v -m -j /home/jail customer01

This may fail with an error message like this:

invalid shell, /home/jail/usr/sbin/jk_lsh does not exist

To fix do this:

jk_init -v -j /home/jail jk_lsh

and try again. You might instead add jk_lsh to the list at step C.

E. Now when trying to connect to customer01, the connection may exit immediately after launching. To fix this issue at /home/jail/etc/passwd change the shell of customer01 and set it to bash like this:

customer01:x:518:601::/home/customer01:/bin/bash

instead of this:

customer01:x:518:601::/home/customer01:/usr/sbin/jk_lsh