0

The error always looks something like this, depending on which shell is configured in /etc/passwd.

su: failed to execute /usr/sbin/jk_chrootsh: Permission denied

OR

su: failed to execute /bin/bash: Permission denied # for a more typical shell

Upon examining both the permissions and file access control lists for /bin/bash, located in /usr/bin/bash, they seem to allow the user backups to read and execute both shells.

┌─[✓]─[\u@\h]─[~]
└──$ stat --format %a /usr/sbin/jk_chrootsh # Get chmod code
777

┌─[✓]─[\u@\h]─[~]
└──$ stat --format %a /usr/bin/bash
755

┌─[✓]─[\u@\h]─[~]
└──$ getfacl /usr/sbin/jk_chrootsh
getfacl: Removing leading '/' from absolute path names
# file: usr/sbin/jk_chrootsh
# owner: root
# group: root
user::rwx
group::rwx
other::rwx

┌─[✓]─[\u@\h]─[~]
└──$ getfacl /usr/bin/bash
getfacl: Removing leading '/' from absolute path names
# file: usr/bin/bash
# owner: root
# group: root
user::rwx
user:backups:rwx  #effective:r-x
group::r-x
mask::r-x
other::r-x

The chmod code of 777 for /bin/bash will clearly allow rwx access to anyone, and the file access control list shows even a specific override for my user to have rwx access.

The chmod code of 755 should also give enough access for jk_chrootsh, with rx access being granted to everyone. Additionally, the facl shows nothing that would restrict the execution ability of anyone to /usr/sbin/jk_chrootsh.

I was concerned that maybe the sbin directory, usually being only for use with the root user, would be blocking read access, but it also allows read and execute access to anyone. I guess it just is not on the default PATH variable for non-root users.

This is the backups user's line in /etc/passwd if needed, too:

backups:x:1002:1002:,,,:/opt/backups/./.:/usr/sbin/jk_chrootsh

Does anyone have any possible leads for solving this problem?

Edit:

As per harrymc's request, /opt/backups/ has the permission code 777, yet is owned by root:root, as sshd requires root to own chroot directories.

14
  • What exactly is your su command? To use the new user profile and variables do su - username.
    – harrymc
    Apr 2, 2022 at 20:20
  • My su command was just sudo su backups. I just tried with sudo su - backups and I received the same error, in addition to this one: su: warning: cannot change directory to /opt/backups/./.: Permission denied. /opt/backups is the home directory by the way. I have that directory purposefully owned by root because I meant to set up backups with an sshd chrootdirectory of /opt/backups.
    – Mini
    Apr 2, 2022 at 20:22
  • Try without the sudo.
    – harrymc
    Apr 2, 2022 at 20:23
  • Without the sudo, I get su: Authentication failure. I definitely typed the password correctly. I also sudo passwd'd the password to just a and I still received "Auth failure"
    – Mini
    Apr 2, 2022 at 20:24
  • 1
    Perhaps su has some protection in it preventing it from launching a shell that is writable by other than root? I see you gave /usr/bin/jk_rootsh 777 permissions. Apr 2, 2022 at 20:45

0

You must log in to answer this question.

Browse other questions tagged .