Re: restricting sftp/ssh login access

[MB <sparkynine@yahoo.com>]

John,

Looks like there is a debian package created for jailkit now:

http://olivier.sessink.nl/jailkit/jailkit_0.9-1_i386.deb

md5 sums for these packages:
de67f1dbf6cec002290fe4faadf53821  jailkit_0.9-1_i386.deb

Mark

--- MB <sparkynine@yahoo.com> wrote:
> John,
> 
> First off, I make a small mistake, the package I used was "jailkit",
> from either:
> 
> http://www.gnu.org/directory/All_Packages_in_Directory/jailkit.html
> or
> http://freshmeat.net/projects/jailkit/
> 
> It has tons of documentation to help you create a jailed environment,
> including loading your jail with whatever executables needed.
> 
> Looks like I simplified my script to one line:
> 
> -----------------------
> #!/bin/bash
> 
> /usr/sbin/jk_socketd
> ------------------------
> 
> This produces a group of daemonized processes:
> nobody   13659 13658  0 Apr18 ?        00:00:00 [jk_socketd]
> 
> 
> but I think that I had a much more elaborate script to
> {start|stop|restart} this daemon, something like:
> 
> 
> /etc/init.d/chroot_jail
> ------------------------
> #!/bin/bash
> 
> case "$1" in
>   start)
>         echo -n "Starting Chroot Jail Server: chroot jail"
>         start-stop-daemon --start --quiet --pidfile
> /var/run/jk_socketd.pid --exec /usr/sbin/jk_socketd -- 
>         echo "."
>         ;;
>   stop)
>         echo -n "Stopping Chroot Jail Server: chroot jail"
>         start-stop-daemon --stop --quiet --oknodo --pidfile
> /var/run/jk_socketd.pid
>         echo "."
>         ;;
> 
>   restart)
>         echo -n "Restarting Chroot Jail Server: chroot jail"       
> start-stop-daemon --stop --quiet --oknodo --retry 30 --pidfile
> /var/run/jk_socketd.pid
>         start-stop-daemon --start --quiet --pidfile
> /var/run/jk_socketd.pid --exec /usr/sbin/jk_socketd -- 
>         echo "."
>         ;;
> 
>   *)
>         echo "Usage: /etc/init.d/chroot_jail {start|stop|restart}"
>         exit 1
> esac
> 
> exit 0
> ---------------------------------------
> 
> 
> Mark
> 
> 
> --- Andreas John <aj@net-lab.net> wrote:
> > Hi Mark!
> > 
> > > You will need to run a special daemon (jk_socketd) to log users
> > into the 
> > > jail, but that is about the hardest part.  I'll post my startup
> > script 
> > > if you would like.
> > 
> > Do I need the ssh-patch if I run this jk_socketd? Does it replace
> > that 
> > patch? It's pain in the ass to maintain an ssh package that is
> > seperate 
> > from the debian tree.
> > 
> > And yes - please post me that startup-script. Would be nice.
> > 
> > Best regards and many pengiuns,
> > Andreas
> > 
> > 
> > -- 
> > Andreas John
> > net-lab GmbH
> > Luisenstrasse 30b
> > 63067 Offenbach
> > Tel: +49 69 85700331
> > 
> > http://www.net-lab.net
> > 
> 
> 
> -- 
> To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact
> listmaster@lists.debian.org
> 
>