Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

By using libpam-chroot it is possible to chroot subset of users quite easily based on an username when user is logging with SSH.

What is a good way to create this chroot and libpam-chroot setup. One of my goals is that chrooted users are only known in chroot environment (no passwords or whatsoever would be stored outside chroot). In my previous setup I needed to manually update users passwords between /etc/shadow and /var/my_chroot/etc/shadow. Is this possible?

Or is there a completely different way to achieve this kind of subsystem without a need of a completely another (virtual)computer (I do not have any spare hardware to offer and I have only 1 network interface)? Or is the virtualization the correct answer after all?

share|improve this question
up vote 2 down vote accepted

Make sure you have UsePAM yes in /etc/ssh/sshd_config, and set up a PAM module that reads a user database from a place inside the chroot. There's no easy way to make pam_unix read different passwd and shadow files, but you can use pam_ldap instead and run an LDAP server inside the chroot (or even better, outside the chroot, storing its data somewhere under /var).

As for whether to use virtualization, that depends what you expect from chrooting. It doesn't provide much security against a user with shell access. For example, a local root hole gives full access to the whole machine; local users can snoop quite a bit outside the chroot by poking inside /proc; network ports used inside the chroot are not available outside; ...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.