Preferred way to create a chroot when chrooting subset of users when logging with SSH?

Question

By using libpam-chroot it is possible to chroot subset of users quite easily based on an username when user is logging with SSH.

What is a good way to create this chroot and libpam-chroot setup. One of my goals is that chrooted users are only known in chroot environment (no passwords or whatsoever would be stored outside chroot). In my previous setup I needed to manually update users passwords between /etc/shadow and /var/my_chroot/etc/shadow. Is this possible?

Or is there a completely different way to achieve this kind of subsystem without a need of a completely another (virtual)computer (I do not have any spare hardware to offer and I have only 1 network interface)? Or is the virtualization the correct answer after all?

Answer 1

Make sure you have UsePAM yes in /etc/ssh/sshd_config, and set up a PAM module that reads a user database from a place inside the chroot. There's no easy way to make pam_unix read different passwd and shadow files, but you can use pam_ldap instead and run an LDAP server inside the chroot (or even better, outside the chroot, storing its data somewhere under /var).

As for whether to use virtualization, that depends what you expect from chrooting. It doesn't provide much security against a user with shell access. For example, a local root hole gives full access to the whole machine; local users can snoop quite a bit outside the chroot by poking inside /proc; network ports used inside the chroot are not available outside; ...