Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

On a 64 bit CentOS host I am using script make_chroot_jail.sh to put a user in a jail, not permitting it to see anything expect it's home at /home/jail/home/user1.

I did it typing this:

sudo ./make_chroot_jail.sh user1

after, when trying to connect to user1 first i was getting an error like:

/bin/su: user guest does not exist

i have fixed this by copying some missed libraries:

sudo cp /lib64/libnss_compat.so.2 /lib64/libnss_files.so.2 /lib64/libnss_dns.so.2 /lib64/libxcrypt.so.2 /home/jail/lib64/
sudo cp -r /lib64/security/ /home/jail/lib64/

But now, when trying to connect to user1 typing su user1 and then typing it's password, i am getting this error:

could not open session

So the question is how to connect to user1 in this situation?

P.S. Here are the permissions of some files, this might be helpful in order to provide a solution:

-rwsr-xr-x 1 root root /home/jail/bin/su
drwxr-xr-x 4 root root /home/jail/etc
-rw-r--r-- 1 root root /home/jail/etc/pam.d/su
-rw-r--r-- 1 root root /home/jail/etc/passwd
-rw------- 1 root root /home/jail/etc/shadow

UPDATE1

After some modifications i managed to connect to user1, but the session closes immediately! I guess this a PAM issue, however cant find a way to fix it.

Here the log entry for close action from /val/log/secure:

Oct  6 15:19:42 localhost su: pam_unix(su:session): session closed for user user1

What makes the session to exit immediately after launching?

share|improve this question
    
You might need to copy some system users and groups into the jail or change some configuration. On my system, /etc/shadow is 640 group shadow. Check the system logs for any relevant message and post them here. Also post the content of /home/jail/etc/pam.d/su. The output of strace -s9999 su user1 could also help. –  Gilles Oct 6 '10 at 21:33
    
@Gilles After some modifications i managed to connect to user1, but now the session closes immediately. So now the question is: what makes the session to exit immediately after launching (please see the UPDATE1 of the question)? Looking to file /val/log/secure, i assume this is some PAM issue, however i dont know how to fix it. Can you help me on this? –  arepo21 Oct 6 '10 at 22:31

2 Answers 2

To fix the could not open session problem, without abandoning make_chroot_jail.sh entirely, you also need to copy the /usr/lib/libcrack* libraries. Edit the script, where it has:

# If you are using a 64 bit system and have strange problems with login comment
# the following lines in, perhaps it will work (motto: if you can't find the
# needed library just copy all of them)
#
# cp /lib/*.* ${JAILPATH}/lib/
# cp /lib/lib64/*.* ${JAILPATH}/lib/lib64/

Change to:

cp /lib/*.* ${JAILPATH}/lib/
cp /lib64/*.* ${JAILPATH}/lib64/
cp -rp /lib64/security ${JAILPATH}/lib64/
cp /usr/lib64/libcrack* ${JAILPATH}/usr/lib64/

Just a quick addendum, the above fixed this problem with 64 bit SuSE - SLES 11 sp2. I also renamed the $JAILPATH/lib to $JAILPATH/lib64. And for that OS, I had to add an empty /etc/profile file in the jail (you can use it to put in a PS1 prompt).

share|improve this answer

I have found a solution.

First of all you should forget about make_chroot_jail.sh and use Jailkit.

I have faced some problems while using it, but eventually everything works.

Here are the steps how I used Jailkit and how I fixed the issues which were occurring:

A. Do ./configure; make; make install as it is describes at INSTALL.txt.

B. Add /usr/sbin to the $PATH if it is not already there.

C. Do this:

jk_init -v -j /home/jail basicshell editors extendedshell netutils ssh sftp scp

This may fail with an error message like this:

`ERROR: configfile /usr/jk_init.ini does not exist`

To fix this, at /usr/sbin/jk_init change INIPREFIX='/usr' to INIPREFIX='/etc/jailkit' and try again.

D. Do this:

jk_jailuser -v -m -j /home/jail customer01

This may fail with an error message like this:

invalid shell, /home/jail/usr/sbin/jk_lsh does not exist

To fix do this:

jk_init -v -j /home/jail jk_lsh

and try again. You might instead add jk_lsh to the list at step C.

E. Now when trying to connect to customer01, the connection may exit immediately after launching. To fix this issue at /home/jail/etc/passwd change the shell of customer01 and set it to bash like this:

customer01:x:518:601::/home/customer01:/bin/bash

instead of this:

customer01:x:518:601::/home/customer01:/usr/sbin/jk_lsh
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.