1

I'm stucked with creating SFTP chroot. I'm able to log in, but i'm getting "Permission denied" whatever I try.

sftp webadm@<ip>:
webadm@<ip>'s password:
Connected to <ip>.
Changing to: /
sftp> ls
remote readdir("/"): Permission denied
sftp>

This is what I did:

/etc/ssh/sshd_config
Subsystem sftp internal-sftp
Match Group sftponly
        ChrootDirectory %h
        ForceCommand internal-sftp
        AllowTcpForwarding no
        PermitTunnel no
        X11Forwarding no

I created user webadm

useradd webadm
passwd webadm
groupadd sftponly
gpasswd -a webadm sftponly
usermod -g sftponly webadm
groups webadm
webadm : sftponly

I followed this howto https://wiki.archlinux.org/index.php/SFTP_chroot

ll /home/
drwx------+ 5 root   root   4096 May 31 23:49 webadm
ll /home/webadm/
-rw-r--r--.  1 webadm sftponly    5 May 31 23:34 test
getfacl /home/webadm/
getfacl: Removing leading '/' from absolute path names
# file: home/webadm/
# owner: root
# group: root
user::rwx
group::---
mask::---
other::---

There is written root has to own chroot dir, but then how webadm user can access content of his dir? I tried to

setfacl -m u:webadm:rwx /home/webadm/

but then I wasn't even able to log in.

I also tried match user in sshd, but same effect

Match User webadm
       ChrootDirectory /home/webadm
       AllowAgentForwarding no
       X11Forwarding no
       AllowTcpForwarding no
       #PermitTTY no
       ForceCommand internal-sftp
       PermitTunnel no

Selinux is in permissive mode. The only error I can see is in /var/log/secure

Accepted password for webadm from <ip> port 19669 ssh2
pam_unix(sshd:session): session opened for user webadm by (uid=0)
sshd_selinux_copy_context: getcon failed with Permission denied [postauth]

So what am I doing wrong? Any help really appreciated. Thank you.

6
  • What OS are you using?
    – Jakuje
    Jun 3, 2016 at 17:11
  • Latest CentOS 7
    – Sigi
    Jun 3, 2016 at 17:36
  • your user webadm has uid=0? That is suspicious.
    – Jakuje
    Jun 3, 2016 at 17:53
  • doesn't it mean, that session was opened by ssh deamon, which is running under root?
    – Sigi
    Jun 3, 2016 at 18:03
  • anyway, I disabled selinux completely and now error message with sshd_selinux_copy_context disappeared. I have to edit title of question later. But result remains the same...
    – Sigi
    Jun 3, 2016 at 18:05

1 Answer 1

1
drwx------+ 5 root   root   4096 May 31 23:49 webadm

Try setting permissions on this direcctory to 755 (rwxr-xr-x) rather than 700. The webadm ID needs Read and eXamine permission on the directory in order to see files within it.

The ssh server will be fine with the director being readable. The chroot feature only requires that the directory not be writable. From the sshd_config manual (emphasis added):

ChrootDirectory
Specifies the pathname of a directory to chroot(2) to after authentication. At session startup sshd(8) checks that all com- ponents of the pathname are root-owned directories which are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory.

I suggest you remove the ACL from the directory as well, unless you need it for some other reason. I don't believe SSHD will consider the ACL when deciding whether the directory is suitable as a chroot directory.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .